NM with dual stacked wireguard endpoint #695

flaruina commented 2026年04月24日 17:09:18 +02:00

Hi,
we noticed that on a Debian 13 machine with eduvpn 4.71 (installed via apt) and ipv4 only connectivity when we connect via wireguard to a dual stacked endpoint, NM resolves its the name and establishes the connection.

The machine gets a IPv6 GUA in the tunnel and after a couple of seconds, when NM re-resolves the endpoint name it modifies the wireguard endpoint IP setting the v6 address (reachable via VPN). This operation breaks the connectivity since the v6 address is not reachable via the main interface.

It seems to be an issue with how NetworkManager manages wg endpoints expressed as names (they take the first result of getaddrinfo).

From https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.41.7-dev/src/core/devices/nm-device-wireguard.c#L44

/* TODO: when we get multiple IP addresses when resolving a peer endpoint. We currently
 * just take the first from GAI. We should only accept AAAA/IPv6 if we also have a suitable
 * IPv6 address. The problem is, that we have to recheck that when IP addressing on other
 * interfaces changes. This makes it almost too cumbersome to implement. */

Here (flaruina/linux-app@69f85172d4) I tried a workaround
in linux-app passing to NetworkManager the IP as reported by getaddrinfo before establishing the tunnel.

I understand this is a workaround and should be fixed upstream in NM but is there a better way in the meantime?

Hi, we noticed that on a Debian 13 machine with eduvpn 4.71 (installed via apt) and ipv4 only connectivity when we connect via wireguard to a dual stacked endpoint, NM resolves its the name and establishes the connection. The machine gets a IPv6 GUA in the tunnel and after a couple of seconds, when NM re-resolves the endpoint name it modifies the wireguard endpoint IP setting the v6 address (reachable via VPN). This operation breaks the connectivity since the v6 address is not reachable via the main interface. It seems to be an issue with how NetworkManager manages wg endpoints expressed as names (they take the first result of getaddrinfo). From https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.41.7-dev/src/core/devices/nm-device-wireguard.c#L44 ``` /* TODO: when we get multiple IP addresses when resolving a peer endpoint. We currently * just take the first from GAI. We should only accept AAAA/IPv6 if we also have a suitable * IPv6 address. The problem is, that we have to recheck that when IP addressing on other * interfaces changes. This makes it almost too cumbersome to implement. */ ``` Here (https://codeberg.org/flaruina/linux-app/commit/69f85172d4ff7c13c46f997619c06d7ae929be70) I tried a workaround in linux-app passing to NetworkManager the IP as reported by `getaddrinfo` before establishing the tunnel. I understand this is a workaround and should be fixed upstream in NM but is there a better way in the meantime?

jwijenbergh commented 2026年05月11日 12:08:50 +02:00

Hi, sorry for the radio silence. I think doing a DNS request in the client is too hacky, but maybe we can guard it behind an env variable. What do you think?

Hi, sorry for the radio silence. I think doing a DNS request in the client is too hacky, but maybe we can guard it behind an env variable. What do you think?

flaruina commented 2026年05月12日 17:00:08 +02:00

No worries. Could you elaborate more on your idea?

Do you mean doing the exact same thing (solving in the client) but only if an env variable is set or something else?

No worries. Could you elaborate more on your idea? Do you mean doing the exact same thing (solving in the client) but only if an env variable is set or something else?