WireGuard Endpoints Now Open to Any Client
Open WireGuard Endpoints
UDP Gateway introduces two new capabilities: WireGuard Listeners can now accept connections from any client without pre-registration, and Lambda destinations can be invoked asynchronously. The open endpoints, controlled by the AllowUnknownPeers property, enable public-facing services where clients generate keys on the fly, with an optional shared PSK gate. Async invocation, via UseAsyncInvoke, lets the gateway fire packets into long-running workflows without waiting for a response. Together, they simplify building event-driven WireGuard services, as demonstrated by a device provisioning example.
It's a packet in, a workflow started, and no infrastructure running between events.
- cube00
>the Listener rejects any handshake from an unknown key.
It never responds, there's no indication of rejection.
The client can't even be sure a service is actually there or they've hit a default drop firewall rule.
- anonymousiam
This is confusing to me, and I'm not a novice to WireGuard.
WireGuard is a layer-3 protocol. Given that WireGuard does not natively support DHCP or dynamic internal IP allocation within its encrypted tunnels, and it instead relies on static tunnel IP configurations (Address and AllowedIPs for each pre-registered client), how would a new unregistered client be assigned an IP address within the encrypted subnet?
- tosti
I think this would nerf wireguard similarly to how a "null" encryption effectively nerfed IPSec. Fine for a specific use case (debugging comes to mind) but should never be upstreamed imho.