<html><head></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><br></div><div>Hello,</div><div><br></div><div>I'm facing a quite annoying problem with wireguard with NetworkManager.</div><div><br></div><div>After reading <a href="https://blogs.gnome.org/thaller/2019/03/15/wireguard-in-networkmanager/">https://blogs.gnome.org/thaller/2019/03/15/wireguard-in-networkmanager/</a></div><div><br></div><div>> *Dynamically Resolving Endpoints*</div><div>> In WireGuard, peers may have an endpoint configured but also [roaming is built-in]</div><div>> NetworkManager supports peer endpoints specified as DNS names: it will resolve the</div><div>> names before configuring the IP address in kernel. NetworkManager resolves endpoint</div><div>> names every 30 minutes or whenever the DNS configuration of the host changes, in</div><div>> order to pick up changes to the endpoint’s IP address.</div><div><br></div><div>I thought great! This is one good reason to let NetworkManager manage wireguard </div><div>instead of using plain wg toolkit.</div><div><br></div><div>My endpoint is a dualstacked IPv6/IPv4 specified by its name, e.g.:</div><div style="margin-left: 3ch;">example.com. 7152 IN A 93.184.216.34</div><div style="margin-left: 3ch;">example.com. 7149 IN AAAA 2606:2800:220:1:248:1893:25c8:1946</div><div><br></div><div>→ "Connecting" from a IPv4 only network or a dual stacked network works just fine!</div><div><br></div><div>→ However, when switching from a IPv4&IPv6 network to a IPv4 only network, Network</div><div>Manager does not seem to realize the endpoint is no longer reachable via IPv6. I </div><div>suspect this is because there is no DNS change and NM just assumes things should</div><div>still be working.</div><div><br></div><div>When checking wg status(sudo wg show wg0), the endpoint is still pointing to the IPv6</div><div>address.</div><div><br></div><div style="margin-left: 3ch;">$ sudo wg show wg0</div><div style="margin-left: 3ch;">interface: wg0</div><div style="margin-left: 3ch;"> public key: SSBrbm93IGkndHMgcHVibGljLCBidXQgaXQncyBhbHNvIGZ1bm55IT8K</div><div style="margin-left: 3ch;"> private key: (hidden)</div><div style="margin-left: 3ch;"> listening port: 55075</div><div style="margin-left: 3ch;"><br></div><div style="margin-left: 3ch;">peer: VGhpcyBpcyBub3Q/IE9rLCBXb24ndCBpdCBkbyBhZ2Fpbgo=</div><div style="margin-left: 3ch;"> endpoint: [2606:2800:220:1:248:1893:25c8:1946]:45333</div><div style="margin-left: 3ch;"> allowed ips: 10.12.13.0/24, fdba:e3b1:1b22:42::/64</div><div style="margin-left: 3ch;"> latest handshake: 1 minute, 40 seconds ago</div><div style="margin-left: 3ch;"> transfer: 632 B received, 984 B sent</div><div><br></div><div><br></div><div>As of now, I have to down&up the profile/connection so it starts working again.</div><div><br></div><div>Actually, I think the "DNS change" NM is monitoring is a DNS change in the client</div><div>configuratoin (like new nameservers, and so on), and not a DNS change in the DNS</div><div>Resource Records (example) as I initialy thought it was when reading the article.</div><div><br></div><div>And indeed, I am moving between Wifi networks which happened to "send" the same DNS</div><div>settings (but one network is dual stacked and the other is not).</div><div><br></div><div>→ Can NM detect this on its own? (the unreachability of an IPv6 Endpoint over an</div><div>IPv4 only network?)</div><div><br></div><div>Many thanks!</div><div><br></div><div>samuel</div><div><br></div><div><br></div><div><br></div><div><br></div><div><span></span></div></body></html>