View original (French)

Wireguard

UnLabrador Posted messages 75 Registration date   Status Member Last intervention   -  
brupala Posted messages 111147 Registration date   Status Member Last intervention   -
Hello,
I recently set up a WireGuard VPN to access my local network while roaming and route all my traffic through the VPN.

My architecture is as follows: PC > VPN on Proxmox VM > local network + internet

My WireGuard server is at 10.0.20.1 and my PC is at 10.0.20.2
The local network I want to access is at 10.0.0.X

I'm encountering two problems: I can ping the WireGuard server from my PC, but I can't access the rest of the local network, and I can't access the internet.
I have enabled interface forwarding.

Here is my server-level configuration file:

[Interface]
PrivateKey = MyServerPrivateKey
Address = 10.0.20.1/24
ListenPort = MyCustomPort
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o et>PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o >

[Peer]
#PC
PublicKey = MyPCPublicKey
AllowedIps = 10.0.20.2/32

And at the client level:

[Interface]
PrivateKey = MyPCPrivateKey
Address = 10.0.20.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = MyServerPublicKey
AllowedIPs = 10.0.20.1/32
Endpoint = ndd:port
PersistentKeepalive = 25

--
Thank you in advance,
--
UnLabrdor

--
My PC:
HP Laptop 17-by0xxx

Proc. i3 7020U
RAM. 8GB DDR4 2133MHz
1TB HDD 5400 RPM
GPU. RADEON 520 series

2 answers

  1.
    avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention   4 511
     
    Hello,

    In the client configuration, the AllowedIPs for the peer corresponding to the server is incorrect. 

    AllowedIPs = 10.0.20.1/32
    indicates that packets from this peer can only have the IP address 10.0.20.1 as the source.
    Thus, the client cannot receive, through this peer (the server), packets with a source from the local network 10.0.0.0/24.

    You need to use 
    AllowedIPs = 0.0.0.0/0
    if you want to route all your traffic through Wireguard.

    This configuration via the configuration file automatically modifies the system's routing table, in contrast to manual configuration (where you create the interface manually, etc.).
    1
    1. brupala Posted messages 111147 Registration date   Status Member Last intervention   14 449
       
      Hi,
      are you sure this ACL is related to routing?
      Not just the VPN addresses?
      But it's possible, I haven't practiced Wireguard yet.
      However,
      I don't quite see why we're doing NAT; it would just be enough to do static routing.
      0
      1. avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention   4 511 > brupala Posted messages 111147 Registration date   Status Member Last intervention  
         
        Hello,

        @brupala
        The Wireguard program modifies the routing table based on the 
        AllowedIPs
        of the 
        [peer]
        in the configuration file, similar to the 
        route
        parameter in OpenVPN configuration.

        For NAT, I assume it’s to make the Wireguard network 10.0.20.0/24 remain unknown outside the virtual machine.

        @UnLabrador
        The iptables commands in PostUp and PostDown are incomplete, and there's also a missing newline before PostDown. Remember to use code tags on CCM to retain the formatting.
        Check that the interface names are correct; we're guessing "and" which I assume is "eth0", but is that indeed the case? Nowadays, it’s often "enpXsX" instead of "ethX".
        You also need to enable forwarding at the kernel level (with sysctl), in addition to allowing it at the firewall level.
        0
      2. brupala Posted messages 111147 Registration date   Status Member Last intervention   14 449 > avion-f16 Posted messages 19182 Registration date   Status Contributor Last intervention  
         
        Yes,
        actually, we have the answer here:
        https://techoverflow.net/2021/07/09/what-does-wireguard-allowedips-actually-do/
        Thank you :-)
        however, 0.0.0.0/0 is a bit broad, actually everyone, I think it should be reduced, especially since we can apparently specify multiple ranges.
        And as I indicated, we also need to plan the route in the other direction.
        0
    2. UnLabrador Posted messages 75 Registration date   Status Member Last intervention   2
       
      Hello,
      I have two configuration files, I had set 0.0.0.0/0 because I have two tunnels, one (which works) just to access the server and another (which doesn't work) to access the remote local network + the internet
      I copied the one to access only the machine
      So, it still doesn't work with 0.0.0.0/0.
      0
  2. brupala Posted messages 111147 Registration date   Status Member Last intervention   14 449
     
    Also,
    does the LAN machine you want to reach have the correct route to 10.0.20.0/24?
    I suppose it is not the default route...

    --
    and ... There you go!
    0
    1. UnLabrador Posted messages 75 Registration date   Status Member Last intervention   2
       
      How to check that?
      0
    2. brupala Posted messages 111147 Registration date   Status Member Last intervention   14 449 > UnLabrador Posted messages 75 Registration date   Status Member Last intervention  
       
      See the routing table of the LAN machine, the server, and the WireGuard client.
      What are the operating systems?
      By the way, does the VM ping well on the local network?
      Is it connected in bridge mode or ... something else?
      0
    3. UnLabrador Posted messages 75 Registration date   Status Member Last intervention   2 > brupala Posted messages 111147 Registration date   Status Member Last intervention  
       
      Hello,
      The WireGuard client is able to ping the WireGuard server at 10.20.0.1 and the VM can ping the client at 10.20.0.2
      The VM can access the local network
      It is running on Debian 11
      0
    4. brupala Posted messages 111147 Registration date   Status Member Last intervention   14 449 > UnLabrador Posted messages 75 Registration date   Status Member Last intervention  
       
      What is its address on the local network?
      And the OS of the target machine on the local network?
      And its address too?
      0
    5. UnLabrador Posted messages 75 Registration date   Status Member Last intervention   2 > brupala Posted messages 111147 Registration date   Status Member Last intervention  
       
      His address on the local network is 10.0.0.110
      My roaming PC is running Windows 11.
      I do not want to access a specific machine, I want to access the entire local network, a sort of site-to-site.
      0