View original (French)

Wireguard
UnLabrador -  
Hello,
I recently set up a WireGuard VPN to access my local network while roaming and route all my traffic through the VPN.

My architecture is as follows: PC > VPN on Proxmox VM > local network + internet

My WireGuard server is at 10.0.20.1 and my PC is at 10.0.20.2
The local network I want to access is at 10.0.0.X

I'm encountering two problems: I can ping the WireGuard server from my PC, but I can't access the rest of the local network, and I can't access the internet.
I have enabled interface forwarding.

Here is my server-level configuration file:

[Interface]
PrivateKey = MyServerPrivateKey
Address = 10.0.20.1/24
ListenPort = MyCustomPort
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o et>PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o >

[Peer]
#PC
PublicKey = MyPCPublicKey
AllowedIps = 10.0.20.2/32

And at the client level:

[Interface]
PrivateKey = MyPCPrivateKey
Address = 10.0.20.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = MyServerPublicKey
AllowedIPs = 10.0.20.1/32
Endpoint = ndd:port
PersistentKeepalive = 25

--
Thank you in advance,
--
UnLabrdor

--
My PC:
HP Laptop 17-by0xxx

Proc. i3 7020U
RAM. 8GB DDR4 2133MHz
1TB HDD 5400 RPM
GPU. RADEON 520 series

2 answers

  1.  avion-f16
    Hello,

    In the client configuration, the AllowedIPs for the peer corresponding to the server is incorrect. 

    AllowedIPs = 10.0.20.1/32
    indicates that packets from this peer can only have the IP address 10.0.20.1 as the source.
    Thus, the client cannot receive, through this peer (the server), packets with a source from the local network 10.0.0.0/24.

    You need to use 
    AllowedIPs = 0.0.0.0/0
    if you want to route all your traffic through Wireguard.

    This configuration via the configuration file automatically modifies the system's routing table, in contrast to manual configuration (where you create the interface manually, etc.).
    1. brupala
      Hi,
      are you sure this ACL is related to routing?
      Not just the VPN addresses?
      But it's possible, I haven't practiced Wireguard yet.
      However,
      I don't quite see why we're doing NAT; it would just be enough to do static routing.
    2. UnLabrador Author
      Hello,
      I have two configuration files, I had set 0.0.0.0/0 because I have two tunnels, one (which works) just to access the server and another (which doesn't work) to access the remote local network + the internet
      I copied the one to access only the machine
      So, it still doesn't work with 0.0.0.0/0.
    3. avion-f16
      @brupalaHello,

      @brupala
      The Wireguard program modifies the routing table based on the 
      AllowedIPs
      of the 
      [peer]
      in the configuration file, similar to the 
      route
      parameter in OpenVPN configuration.

      For NAT, I assume it’s to make the Wireguard network 10.0.20.0/24 remain unknown outside the virtual machine.

      @UnLabrador
      The iptables commands in PostUp and PostDown are incomplete, and there's also a missing newline before PostDown. Remember to use code tags on CCM to retain the formatting.
      Check that the interface names are correct; we're guessing "and" which I assume is "eth0", but is that indeed the case? Nowadays, it’s often "enpXsX" instead of "ethX".
      You also need to enable forwarding at the kernel level (with sysctl), in addition to allowing it at the firewall level.
  2. brupala
    Also,
    does the LAN machine you want to reach have the correct route to 10.0.20.0/24?
    I suppose it is not the default route...

    --
    and ... There you go!
    1. UnLabrador Author
      How to check that?
    2. brupala
      @UnLabradorSee the routing table of the LAN machine, the server, and the WireGuard client.
      What are the operating systems?
      By the way, does the VM ping well on the local network?
      Is it connected in bridge mode or ... something else?
    3. UnLabrador Author
      @brupalaHello,
      The WireGuard client is able to ping the WireGuard server at 10.20.0.1 and the VM can ping the client at 10.20.0.2
      The VM can access the local network
      It is running on Debian 11
    4. brupala
      @UnLabradorWhat is its address on the local network?
      And the OS of the target machine on the local network?
      And its address too?
    5. UnLabrador Author
      @brupalaHis address on the local network is 10.0.0.110
      My roaming PC is running Windows 11.
      I do not want to access a specific machine, I want to access the entire local network, a sort of site-to-site.