1

I am having CentOS 7.6 version, and I installed test Wireguard VPN server. The whole installation and configuration is pretty easy, at least according to documentation, so what I did, I installed wireguard-tools, wireguard-dkms and linux-headers

next step was, that I generated private and public key of the server, and wrote configuration of the server as:

[Interface]
Address = 10.7.0.1/24
ListenPort = 34777
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=

[Peer]
PublicKey  = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.2/32

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.3/32

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.4/32

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.5/32

from the server side I opened port 34777 udp on a firewall, and set sysctl -w net.ipv4.ip_forward (to enable forwarding) as this server should suppose to forward traffic from client to other servers in the subnet of the VPN server. Now lets imagine that public IP of this server is 11.11.11.11/23

On the client side, configuration looks like this:

[Interface]
Address = 10.7.0.4/24
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.1/32,11.11.11.0/23 (for having route to 11.11.11.0/23 subnet) or 0.0.0.0/0
Endpoint = 11.11.11.11:34777

now 0.0.0.0/0 means that I will forward all traffic to my VPN (its not mandatory), it can be a split tunnel.... what I don't understand, when I connect, I can ping interface of the server 10.7.0.1, but I cannot ping anything from the network 11.11.11.0/23. Since network 11.11.11.0/23 is public, there is no NAT. Also to mention, on the CentOS I use firewalld instead of iptables.

How and why cannot I see the internal network behind tunneled interface?

picture how setup looks like: enter image description here

P.S. On the picture, between host A and Wireguard server, there is another linux router (a main router), so please keep in mind that.

1

After so many try and fail and brainstorming with wireguard IRC chanel guys, apparently I forgot to add a static route for 10.7.0.0/24 for each server behind wireguard. Ping goes to the server, but does not return as server does not know where to send that echo-reply:

ip route add 10.7.0.0/24 via 11.11.11.11 dev eth0 (main device for communication)

For me, problem solved ;-)

1

I ran into the same problem - my server aka "Wireguard SRV" in rhe diagram (=Centos8, with iptables and ferm) doesn't route traffic.

The problem: I forgot to sysctl -w net.ipv4.ip_forward=1.
But that was not the only issue - ip route add ... was not the solution.

So I added these lines to my wireguard-config (located at /etc/wireguard/wg0.conf according to your addresses):

[Interface]
// ...
PreUp = iptables -A POSTROUTING -s 10.7.0.0/24 -o eth0 -j SNAT --to-source 11.11.11.11 -t nat
PreDown = iptables -D POSTROUTING -s 10.7.0.0/24 -o eth0 -j SNAT --to-source 11.11.11.11 -t nat

  • Where do you add this? On left hand server or right hand server? – gurpal2000 yesterday
  • What is a left and a right hand server? – akop yesterday
  • Sorry: in your diagram where did you add the iptables rules on "Host A" or "Wireguard SRV" ? – gurpal2000 yesterday
  • Ah. Now I got it. On the "Wireguard SRV". – akop yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.