AllowedIPs
In the lab, R2 lists both the tunnel subnet and site A's LAN as R1's AllowedIPs. R1 was deliberately configured with only the tunnel subnet. The tunnel works, but a ping from host A to host B fails, and R1 itself says why: sendmsg: Required key not available.
AllowedIPs does two jobs at once:
- Outbound, it's a routing table. When a packet goes into wg0, WireGuard looks up its destination in the AllowedIPs of every peer and encrypts it for the matching peer. 10.2.0.10 doesn't match any peer on R1, so there's no key to encrypt with, and the kernel refuses to send it.
- Inbound, it's an access list. A decrypted packet is accepted only if its source address is in the sending peer's AllowedIPs. That's how WireGuard stops one site spoofing another's addresses.
So the route sending 10.2.0.0/24 into wg0 isn't enough on its own: site B's LAN must also be in that peer's AllowedIPs. Add it, and everything works. Traceroute from site A shows one routed hop through the tunnel (R2's tunnel address, 10.255.0.2) and then host B.
And on the internet in between, a capture shows only UDP between the two WAN addresses on port 51820. The private addresses, the ICMP and everything else are inside the encryption.
root@hosta:~# ping -c 2 -W 2 10.2.0.10
PING 10.2.0.10 (10.2.0.10) 56(84) bytes of data.
From 10.1.0.1 icmp_seq=1 Destination Host Unreachable
From 10.1.0.1 icmp_seq=2 Destination Host Unreachable
--- 10.2.0.10 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1007ms
vyos@R1:~$ ping 10.2.0.10 count 2
PING 10.2.0.10 (10.2.0.10) 56(84) bytes of data.
From 10.255.0.1 icmp_seq=1 Destination Host Unreachable
/bin/ping: sendmsg: Required key not available
From 10.255.0.1 icmp_seq=2 Destination Host Unreachable
/bin/ping: sendmsg: Required key not available
--- 10.2.0.10 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1007ms- Lines 3–4: From host A: R1 can't deliver it.
- Line 11: From R1 itself: no peer's AllowedIPs covers 10.2.0.10, so there's no key to encrypt with.
set interfaces wireguard wg0 peer SITE-B allowed-ips '10.2.0.0/24'- Line 1: Site B's LAN, through this peer.
root@hosta:~# ping -c 2 10.2.0.10
PING 10.2.0.10 (10.2.0.10) 56(84) bytes of data.
64 bytes from 10.2.0.10: icmp_seq=1 ttl=62 time=15.0 ms
64 bytes from 10.2.0.10: icmp_seq=2 ttl=62 time=9.01 ms
--- 10.2.0.10 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1006ms
rtt min/avg/max/mdev = 9.008/12.018/15.028/3.010 ms
root@hosta:~# traceroute -n -q 1 10.2.0.10
traceroute to 10.2.0.10 (10.2.0.10), 30 hops max, 60 byte packets
1 10.1.0.1 4.974 ms
2 10.255.0.2 11.431 ms
3 10.2.0.10 13.865 ms- Lines 3–4: Host A reaches host B.
- Line 11: Through R1…
- Line 12: …into the tunnel to R2…
- Line 13: …to host B.
root@inet:~# timeout 8 tcpdump -lni eth1 -c 6
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), snapshot length 262144 bytes
14:16:17.950122 IP 203.0.113.2.51820 > 198.51.100.2.51820: UDP, length 128
14:16:17.953739 IP 198.51.100.2.51820 > 203.0.113.2.51820: UDP, length 128
14:16:18.951156 IP 203.0.113.2.51820 > 198.51.100.2.51820: UDP, length 128
14:16:18.955179 IP 198.51.100.2.51820 > 203.0.113.2.51820: UDP, length 128
14:16:18.964457 IP 203.0.113.2.51820 > 198.51.100.2.51820: UDP, length 96
14:16:18.964650 IP 203.0.113.2.51820 > 198.51.100.2.51820: UDP, length 96
6 packets captured
28 packets received by filter
0 packets dropped by kernel- Lines 4–9: Only UDP 51820 between the public addresses. Everything else is encrypted inside.
Check your understanding
A WireGuard handshake succeeds, but R1 reports 'Required key not available' when sending to 10.2.0.10. Why?
- 10.2.0.10 isn't in any peer's AllowedIPs on R1
- The keys don't match
- UDP 51820 is blocked
- There's no route to 10.2.0.0/24