Scanning network from Wireguard tunnel results in "expression rejects all packets" yet local network scan works without issue
Open
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 592
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
I'm trying to scan network that is on the other side of wireguard tunnel. That will results in: Error compiling our pcap filter: expression rejects all packets. Scaning with same setup my local network is working correct.
To Reproduce
Steps to reproduce the behavior:
- Install WireGuard on Windows
- Connect wireguard with wireguard server and allow only ip from that network and wireguard interface ex. 192.168.200.0/24
- nmap 192.168.200.1
- Get error
Error compiling our pcap filter: expression rejects all packets.
Expected behavior
I should be able to scan host on other side of Wireguard tunnel
Diagnostic information
- windows 11 pro 22621
- Output of DiagReport
*************************************************
DiagReport for Npcap ( https://npcap.com )
*************************************************
Script Architecture: 64-bit
Script Path: C:\Program Files\Npcap\DiagReport.ps1
Current Time: 10/09/2022 00:34:59
Npcap install path: C:\Program Files\Npcap
Npcap Version: 1.71
PowerShell Version: 5.1.22621.608
*************************************************
OS Info:
*************************************************
Caption : Microsoft Windows 11 Pro
BuildNumber : 22621
Locale : 0415
MUILanguages : {pl-PL}
OSArchitecture : 64-bitowy
ServicePackMajorVersion : 0
ServicePackMinorVersion : 0
SystemDirectory : C:\WINDOWS\system32
Version : 10.0.22621
*************************************************
CPU Info:
*************************************************
Name : Intel(R) Core(TM) i5-4670K CPU @ 3.40GHz
Manufacturer : GenuineIntel
DeviceID : CPU0
NumberOfCores : 4
NumberOfEnabledCore : 4
NumberOfLogicalProcessors : 4
Addresswidth : 64
*************************************************
Memory Info:
*************************************************
Size: 16328 MB (17121157120 Bytes)
*************************************************
Network Adapter(s) Info:
*************************************************
Caption : [00000001] Realtek PCIe GbE Family Controller
GUID : {8A0D060B-B2AC-4F17-8825-39AD4B290058}
Index : 1
InterfaceIndex : 14
Manufacturer : Realtek
MACAddress : D4:3D:7E:D7:12:A9
Speed : 1000000000
NetConnectionID : Ethernet 2
NetConnectionStatus : 2
PNPDeviceID : PCI\VEN_10EC&DEV_8168&SUBSYS_78511462&REV_0C\4&27483E63&0&00E2
ServiceName : rt640x64
AdapterType : Ethernet 802.3
Caption : [00000002] VirtualBox Host-Only Ethernet Adapter
GUID : {9D3030CA-93D1-4788-A1B4-F0F1A0841F51}
Index : 2
InterfaceIndex : 16
Manufacturer : Oracle Corporation
MACAddress : 0A:00:27:00:00:10
Speed : 1000000000
NetConnectionID : VirtualBox Host-Only Network
NetConnectionStatus : 2
PNPDeviceID : ROOT\NET\0000
ServiceName : VBoxNetAdp
AdapterType : Ethernet 802.3
Caption : [00000003] LogMeIn Hamachi Virtual Ethernet Adapter
GUID : {3D02AAFD-8417-4D65-813F-6B347290BEC8}
Index : 3
InterfaceIndex : 8
Manufacturer : LogMeIn Inc.
MACAddress :
Speed :
NetConnectionID : Hamachi
NetConnectionStatus : 4
PNPDeviceID : ROOT\NET\0001
ServiceName : Hamachi
AdapterType :
Caption : [00000004] Realtek PCIe GbE Family Controller
GUID : {E1B39525-36AE-4B42-A340-6B79AAFB2AB7}
Index : 4
InterfaceIndex : 20
Manufacturer : Realtek
MACAddress : D4:3D:7E:D7:12:A8
Speed : 9223372036854775807
NetConnectionID : Ethernet
NetConnectionStatus : 7
PNPDeviceID : PCI\VEN_10EC&DEV_8168&SUBSYS_78511462&REV_0C\4&17B0DE03&0&00E3
ServiceName : rt640x64
AdapterType : Ethernet 802.3
Caption : [00000005] Intel(R) Centrino(R) Wireless-N 2230
GUID : {046D88C9-EAB1-4315-805A-E0FCA2CCFDB4}
Index : 5
InterfaceIndex : 2
Manufacturer : Intel Corporation
MACAddress : 68:17:29:41:18:83
Speed : 9223372036854775807
NetConnectionID : Wi-Fi
NetConnectionStatus : 7
PNPDeviceID : PCI\VEN_8086&DEV_0887&SUBSYS_40628086&REV_C4\4&33814C64&0&00E4
ServiceName : NETwNe64
AdapterType : Ethernet 802.3
Caption : [00000017] WireGuard Tunnel
GUID : {0B55DCEC-2AB9-BD10-80FF-D7A77973D76B}
Index : 17
InterfaceIndex : 58
Manufacturer : WireGuard LLC
MACAddress :
Speed : 100000000000
NetConnectionID : DataCenter01
NetConnectionStatus : 2
PNPDeviceID : SWD\WIREGUARD\{0B55DCEC-2AB9-BD10-80FF-D7A77973D76B}
ServiceName : WireGuard
AdapterType :
*************************************************
NDIS Light-Weight Filter (LWF) Info:
*************************************************
HKLM:\SYSTEM\CurrentControlSet\Control\Network\{4d36e974-e325-11ce-bfc1-08002be10318}\*:
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262144
ComponentId : ms_bridge
Description : @%SystemRoot%\system32\bridgeres.dll,-2
InfPath : netbrdg.inf
InfSection : Install
LocDescription : @%SystemRoot%\system32\bridgeres.dll,-2
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262184
ComponentId : ms_wfplwf_lower
Description : @%windir%\System32\drivers\wfplwfs.sys,-6006
InfPath : wfplwfs.inf
InfSection : WfpLwf_Lower_Install
LocDescription : @%windir%\System32\drivers\wfplwfs.sys,-6006
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 40
ComponentId : ms_netbios
Description : @%windir%\system32\drivers\netbios.sys,-501
InfPath : netnb.inf
InfSection : NetBIOS.ndi
LocDescription : @%windir%\system32\drivers\netbios.sys,-501
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262200
ComponentId : ms_ndiscap
Description : @%windir%\System32\drivers\ndiscap.sys,-5000
InfPath : ndiscap.inf
InfSection : Install
LocDescription : @%windir%\System32\drivers\ndiscap.sys,-5000
InstallTimeStamp : {221, 7, 12, 0...}
ComponentId : ms_server
Description : @%systemroot%\system32\srvsvc.dll,-109
InfPath : Netserv.inf
InfSection : Install.ndi
LocDescription : @%systemroot%\system32\srvsvc.dll,-109
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262144
ComponentId : vms_vsf
Description : @%windir%\System32\drivers\vmswitch.sys,-60005
InfPath : wvms_vsft.inf
InfSection : VMSVSF.ndi
LocDescription : @%windir%\System32\drivers\vmswitch.sys,-60005
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262184
ComponentId : ms_vwifi
Description : @%windir%\System32\drivers\vwififlt.sys,-105
InfPath : netvwififlt.inf
InfSection : Install
LocDescription : @%windir%\System32\drivers\vwififlt.sys,-105
InstallTimeStamp : {230, 7, 9, 0...}
Characteristics : 262144
ComponentId : oracle_VBoxNetLwf
Description : @oem15.inf,%vboxnetlwf_desc%;VirtualBox NDIS6 Bridged Networking Driver
InfPath : oem15.inf
InfSection : VBoxNetLwf.ndi
LocDescription : @oem15.inf,%vboxnetlwf_desc%;VirtualBox NDIS6 Bridged Networking Driver
InstallTimeStamp : {230, 7, 10, 0...}
Characteristics : 262144
ComponentId : insecure_npcap
Description : @oem32.inf,%npf_desc_standard%;Npcap Packet Driver (NPCAP)
InfPath : oem32.inf
InfSection : FilterStandard
LocDescription : @oem32.inf,%npf_desc_standard%;Npcap Packet Driver (NPCAP)
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262144
ComponentId : ms_pacer
Description : @%windir%\System32\drivers\pacer.sys,-101
InfPath : netpacer.inf
InfSection : Install
LocDescription : @%windir%\System32\drivers\pacer.sys,-101
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262184
ComponentId : ms_wfplwf_upper
Description : @%windir%\System32\drivers\wfplwfs.sys,-6005
InfPath : wfplwfs.inf
InfSection : WfpLwf_Upper_Install
LocDescription : @%windir%\System32\drivers\wfplwfs.sys,-6005
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262184
ComponentId : ms_nativewifip
Description : @%windir%\System32\drivers\nwifi.sys,-101
InfPath : netnwifi.inf
InfSection : MS_NWIFI.Install
LocDescription : @%windir%\System32\drivers\nwifi.sys,-101
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262144
ComponentId : ms_wfplwf_vswitch
Description : @%windir%\System32\drivers\wfplwfs.sys,-6004
InfPath : wfplwfs.inf
InfSection : WfpLwf_vSwitch_Install
LocDescription : @%windir%\System32\drivers\wfplwfs.sys,-6004
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262144
ComponentId : ms_l2bridge
Description : @%SystemRoot%\System32\drivers\l2bridge.sys,-5000
InfPath : l2bridge.inf
InfSection : Install
LocDescription : @%SystemRoot%\System32\drivers\l2bridge.sys,-5000
InstallTimeStamp : {221, 7, 12, 0...}
Characteristics : 262184
ComponentId : ms_winvfp
Description : Microsoft Azure VFP Switch Filter Extension
InfPath : vfpfilter.inf
InfSection : Install
LocDescription : Microsoft Azure VFP Switch Filter Extension
Name DisplayName ComponentID Enabled
---- ----------- ----------- -------
Ethernet Npcap Packet Driver (NPCAP) insecure_npcap True
VirtualBox Host-Only Network Npcap Packet Driver (NPCAP) insecure_npcap True
Ethernet 2 Npcap Packet Driver (NPCAP) insecure_npcap True
Hamachi Npcap Packet Driver (NPCAP) insecure_npcap True
DataCenter01 Npcap Packet Driver (NPCAP) insecure_npcap True
Wi-Fi Npcap Packet Driver (NPCAP) insecure_npcap True
*************************************************
File Info:
*************************************************
LastWriteTime : 18.08.2022 19:49:28
Length : 815
Name : CheckStatus.bat
LastWriteTime : 09.10.2022 00:34:58
Length : 0
Name : DiagReport-20221009-003458.txt
LastWriteTime : 18.08.2022 19:49:28
Length : 1042
Name : DiagReport.bat
LastWriteTime : 18.08.2022 19:49:28
Length : 18078
Name : DiagReport.ps1
LastWriteTime : 18.08.2022 19:49:28
Length : 2513
Name : FixInstall.bat
LastWriteTime : 09.10.2022 00:19:54
Length : 35382
Name : install.log
LastWriteTime : 18.08.2022 19:49:28
Length : 11547
Name : LICENSE
LastWriteTime : 19.08.2022 21:59:06
Length : 12707
Name : npcap.cat
LastWriteTime : 19.08.2022 21:59:06
Length : 8844
Name : npcap.inf
LastWriteTime : 19.08.2022 21:59:06
Length : 77336
Name : npcap.sys
LastWriteTime : 19.08.2022 21:59:06
Length : 2433
Name : npcap_wfp.inf
LastWriteTime : 19.08.2022 21:09:18
Length : 308176
Name : NPFInstall.exe
LastWriteTime : 09.10.2022 00:19:36
Length : 55015
Name : NPFInstall.log
LastWriteTime : 19.08.2022 22:00:14
Length : 1081352
Name : Uninstall.exe
Path : C:\Program Files\Npcap\npcap.cat
Status : Valid
StatusMessage : Signature verified.
Thumbprint : 451B7F8A4C0E669189E9382A09E423C2B875AD42
Path : C:\Program Files\Npcap\npcap.inf
Status : Valid
StatusMessage : Signature verified.
Thumbprint : 451B7F8A4C0E669189E9382A09E423C2B875AD42
Path : C:\Program Files\Npcap\npcap.sys
Status : Valid
StatusMessage : Signature verified.
Thumbprint : 451B7F8A4C0E669189E9382A09E423C2B875AD42
Path : C:\Program Files\Npcap\NPFInstall.exe
Status : Valid
StatusMessage : Signature verified.
Thumbprint : 3C0D087ECDCC76D1084ABE00F1FEE5040400AE37
Path : C:\Program Files\Npcap\Uninstall.exe
Status : Valid
StatusMessage : Signature verified.
Thumbprint : 3C0D087ECDCC76D1084ABE00F1FEE5040400AE37
LastWriteTime : 19.08.2022 21:09:20
Length : 156624
Name : NpcapHelper.exe
LastWriteTime : 19.08.2022 21:09:18
Length : 219600
Name : Packet.dll
LastWriteTime : 19.08.2022 21:09:20
Length : 266704
Name : WlanHelper.exe
LastWriteTime : 19.08.2022 21:09:20
Length : 489424
Name : wpcap.dll
LastWriteTime : 19.08.2022 21:09:20
Length : 156624
Name : NpcapHelper.exe
LastWriteTime : 19.08.2022 21:09:18
Length : 219600
Name : Packet.dll
LastWriteTime : 19.08.2022 21:09:20
Length : 266704
Name : WlanHelper.exe
LastWriteTime : 19.08.2022 21:09:20
Length : 489424
Name : wpcap.dll
*************************************************
WinPcap Info:
*************************************************
HKLM:\SOFTWARE\WOW6432Node\WinPcap:
Not present.
*************************************************
Registry Info:
*************************************************
HKLM:\SOFTWARE\WOW6432Node\Npcap:
AdminOnly : 0
WinPcapCompatible : 1
(default) : C:\Program Files\Npcap
HKLM:\SYSTEM\CurrentControlSet\Services\npcap:
Type : 1
Start : 1
ErrorControl : 1
Tag : 32
ImagePath : \SystemRoot\system32\DRIVERS\npcap.sys
DisplayName : @oem32.inf,%NPF_Desc_Standard%;Npcap Packet Driver (NPCAP)
Group : NDIS
Description : @oem32.inf,%NPF_Desc_Standard%;Npcap Packet Driver (NPCAP)
NdisMajorVersion : 6
NdisMinorVersion : 50
DriverMajorVersion : 1
DriverMinorVersion : 71
HKLM:\SYSTEM\CurrentControlSet\Services\npcap\Parameters:
LoopbackSupport : 1
DltNull : 1
Edition : Npcap
AdminOnly : 0
Dot11Support : 0
NdisImPlatformBindingOptions : 2
DefaultFilterSettings : 1
VlanSupport : 0
WinPcapCompatible : 1
HKLM:\SYSTEM\CurrentControlSet\Services\npcap_wifi:
Start : 4
HKLM:\SYSTEM\CurrentControlSet\Services\npf:
Not present.
HKLM:\SYSTEM\CurrentControlSet\Services\npf\Parameters:
Not present.
HKLM:\SYSTEM\CurrentControlSet\Services\npf_wifi:
Not present.
*************************************************
Service Info:
*************************************************
Status : Running
Name : npcap
DisplayName : Npcap Packet Driver (NPCAP)
Get-Service : Cannot find any service with service name 'npf'.
At C:\Program Files\Npcap\DiagReport.ps1:214 char:1
+ Get-Service npf
+ ~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (npf:String) [Get-Service], ServiceCommandException
+ FullyQualifiedErrorId : NoServiceFoundForGivenName,Microsoft.PowerShell.Commands.GetServiceCommand
*************************************************
Install Info:
*************************************************
Please refer to: C:\Program Files\Npcap\install.log
Additional context
- I tried ncap 0.992, 1.50, 1.60, 1.70, 1.71
- wireshark 4.0 works fine with 1.71
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing nmap 192.168.200.1 over the WireGuard tunnel and review the diagnostics generated by DiagReport.ps1. Trace the Npcap filter-compilation path associated with the reported error. Done means scans through the tunnel succeed while local network scans continue to work.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100