No public Internet when I activate Fly.io Wireguard

1

When I activate the Wireguard network on macOS to connect to my app’s machines hosted in JNB region, my public Internet stops working, as if all traffic is being routed through the VPN. AllowedIPs = fdaa:9:a7d3::/48 is set in the config to the Fly.io subnet. I. also can’t ping (ping6) any of my Fly machines,

I ran fly wireguard create and followed the steps to output a Wireguard config. I installed Wireguard and imported the config to Wireguard. When I activate the network, I can’t run any fly CLI commands or access the public Internet. When I deactivate it, I can access the public Internet again.

Is this an issue with the Wireguard config or with Wireguard on macOS?

Here is the Wireguard config with obfuscated PrivateKey:

[Interface]
PrivateKey = {obfuscated}
Address = fdaa:9:a7d3:a7b:9476:0:a:2/120
DNS = fdaa:9:a7d3::3

[Peer]
PublicKey = kSN5s1TLpbKpr0Q72goFNomfOzPiCWnwjQKiumjPwQY=
AllowedIPs = fdaa:9:a7d3::/48
Endpoint = lhr2.gateway.6pn.dev:51820
PersistentKeepalive = 15
2

This seems to have magically resolved. No idea what changed (did not reboot).

3

I don’t use my Fly VPN often, but I’ve seen this behaviour as well. No idea what causes it.

1 Like
4

I am having the same problem now :frowning: , I have even tried to change the AllowedIPs to 0.0.0.0::/0

5

I suspect the problem isn’t that your internet traffic is being routed via Fly’s WireGuard connection - but that your (internet) DNS requests are being sent via Fly WireGuard (DNS = fdaa:9:a7d3::3). No DNS = no internet. If for whatever reason your Fly WireGuard isn’t working - then neither will those DNS requests to Fly’s fdaa:9:a7d3::3 servers, as would also be the case if Fly had WireGuard DNS issues.

“I also can’t ping (ping6) any of my Fly machines” - are you pinging via the machine name/Fly Private Network FQDN (i.e. reliant on Fly DNS)? It may not be the ICMP/WireGuard itself that isn’t working - but DNS. Try a ping6 to the machine’s IPv6 IP.

If Fly (or your client) are having any DNS/DNS-over-WireGuard/WireGuard connectivity issues with fdaa:9:a7d3::3 - then your internet connectivity (read: DNS) may appear to be failing when connected to Fly WireGuard.

6

I did try to ping6 the IPv6 address directly, and it was not responding at the time. I can ping6 both the IPv6 address and .internal DNS now.

Btw. latency is super high from Cape Town to Johannesburg region (JNB): 360-450ms. Same on fibre and 4G (slightly higher). Should be ~20-26ms.

7

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.