I wish (Linux) WireGuard had a simple way to restrict peer public IPs

Chris Siebenmann discusses the limitations of WireGuard, a tool for creating encrypted connections, particularly regarding the restriction of peer public IP addresses. Unlike SSH, which allows for IP restrictions through the 'from="..."' option in the authorized keys, WireGuard does not provide a straightforward method to enforce such restrictions. While it is possible to set an expected public IP for a peer, WireGuard will update its records if the peer connects from a different IP, which can be problematic for secure connections that require fixed IPs. The author notes that while firewall rules can be used to restrict access to the WireGuard port, they have limitations, such as not being able to differentiate between multiple peers using the same key. This could lead to security vulnerabilities. To effectively manage multiple peers, different listening ports or separate WireGuard interfaces are necessary, complicating the setup. Siebenmann also speculates on the potential for developing an extension for nftables or iptables that could integrate with WireGuard to better manage peer identities, possibly using eBPF programs.

- WireGuard lacks a simple method to restrict peer public IPs, unlike SSH.

- Firewall rules can restrict access but do not differentiate between peers effectively.

- Multiple listening ports or separate interfaces are needed for managing multiple peers securely.

- The author suggests potential development of kernel-level extensions for better peer management.

- The discussion highlights the need for improved security features in WireGuard implementations.