7

I am having CentOS 7.6 version, and I installed test Wireguard VPN server. The whole installation and configuration is pretty easy, at least according to documentation, so what I did, I installed wireguard-tools, wireguard-dkms and linux-headers

next step was, that I generated private and public key of the server, and wrote configuration of the server as:

[Interface]
Address = 10.7.0.1/24
ListenPort = 34777
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=

[Peer]
PublicKey  = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.2/32

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.3/32

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.4/32

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.5/32

from the server side I opened port 34777 udp on a firewall, and set sysctl -w net.ipv4.ip_forward (to enable forwarding) as this server should suppose to forward traffic from client to other servers in the subnet of the VPN server. Now lets imagine that public IP of this server is 11.11.11.11/23

On the client side, configuration looks like this:

[Interface]
Address = 10.7.0.4/24
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=

[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs = 10.7.0.1/32,11.11.11.0/23 (for having route to 11.11.11.0/23 subnet) or 0.0.0.0/0
Endpoint = 11.11.11.11:34777

now 0.0.0.0/0 means that I will forward all traffic to my VPN (its not mandatory), it can be a split tunnel.... what I don't understand, when I connect, I can ping interface of the server 10.7.0.1, but I cannot ping anything from the network 11.11.11.0/23. Since network 11.11.11.0/23 is public, there is no NAT. Also to mention, on the CentOS I use firewalld instead of iptables.

How and why cannot I see the internal network behind tunneled interface?

picture how setup looks like: enter image description here

P.S. On the picture, between host A and Wireguard server, there is another linux router (a main router), so please keep in mind that.

1
  • I've got this all figured out in my Ansible role. See the client and server configurations. It was written for Debian-ish systems so patches welcome. :)
    – colan
    Feb 3, 2021 at 1:54

3 Answers 3

9

After so many try and fail and brainstorming with wireguard IRC chanel guys, apparently I forgot to add a static route for 10.7.0.0/24 for each server behind wireguard. Ping goes to the server, but does not return as server does not know where to send that echo-reply:

ip route add 10.7.0.0/24 via 11.11.11.11 dev eth0 (main device for communication)

For me, problem solved ;-)

2
  • 2
    Should this be run on Host A or Wireguard SRV?
    – colan
    Apr 2, 2020 at 15:28
  • Added this via the router on a UDMP and works perfect!
    – Ivor
    Jun 18, 2021 at 19:03
8

I ran into the same problem - my server aka "Wireguard SRV" in rhe diagram (=Centos8, with iptables and ferm) doesn't route traffic.

The problem: I forgot to sysctl -w net.ipv4.ip_forward=1.
But that was not the only issue - ip route add ... was not the solution.

So I added these lines to my wireguard-config (located at /etc/wireguard/wg0.conf according to your addresses):

[Interface]
// ...
PreUp = iptables -A POSTROUTING -s 10.7.0.0/24 -o eth0 -j SNAT --to-source 11.11.11.11 -t nat
PreDown = iptables -D POSTROUTING -s 10.7.0.0/24 -o eth0 -j SNAT --to-source 11.11.11.11 -t nat

5
  • Where do you add this? On left hand server or right hand server?
    – gurpal2000
    Mar 28, 2020 at 23:39
  • What is a left and a right hand server?
    – akop
    Mar 29, 2020 at 0:06
  • Sorry: in your diagram where did you add the iptables rules on "Host A" or "Wireguard SRV" ?
    – gurpal2000
    Mar 29, 2020 at 0:17
  • Ah. Now I got it. On the "Wireguard SRV".
    – akop
    Mar 29, 2020 at 9:40
  • 3
    Even easier: iptables -A POSTROUTING -o eth0 -j MASQUERADE -t nat
    – Raman
    Jun 14, 2020 at 6:03
2

Need to enable wg intf like wg0 self-forwarding

iptables -I FORWARD -i wg0 -o wg0 -j ACCEPT
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .