0

I've setup a WireGuard VPN, however after successfully connecting with the following command the browser is not loading web pages from the internet:

wg-quick up `pwd`/myifwg0.conf

I checked the Server WireGuard interface - it looks OK:

$ sudo wg show wg0
interface: wg0
  public key: <SERVER_PUB_KEY>
  private key: (hidden)
  listening port: 51820

peer: <CLIENT_PUB_KEY>
  endpoint: <SERVER_PUBLIC_IP>:45884
  allowed ips: 10.0.1.2/32
  latest handshake: 4 minutes, 44 seconds ago
  transfer: 2.32 KiB received, 3.63 KiB sent

I checked the Client WireGuard interface while connected - it looks OK:

$ sudo wg show myifwg0 
interface: myifwg0
  public key: <CLIENT_PUB_KEY>
  private key: (hidden)
  listening port: 59386
  fwmark: 0xca6c

peer: <SERVER_PUB_KEY>
  endpoint: <SERVER_PUBLIC_IP>:51820
  allowed ips: 0.0.0.0/0, ::/0
  latest handshake: 15 seconds ago
  transfer: 124 B received, 8.63 KiB sent
  persistent keepalive: every 25 seconds

I noticed that when connected to the Server WireGuard VPN, these commands hang forever:

curl google.com
ping google.com

It might be something related to a DNS issue because I am able to nslookup google.com and if I copy / paste the resolved IP from nslookup into the web browser while connected to the VPN, then I am able to visit the google.com homepage.

I've tried to force a DNS IP in the VPN Client configuration file e.g. DNS = 1.1.1.1 or DNS = 8.8.8.8 or DNS = 127.0.0.53 (this last one coming from /etc/resolv.conf), but the effect is the same:

  1. my web browser can not reach web pages
  2. commands like curl or ping cannot resolve domains

In the VPN Client these are the versions:

  • apt-cache show wireguard: Version: 1.0.20200513-1~20.04.2
  • lsb_release -a: Ubuntu 20.04.2 LTS focal

How can I fix the configuration of either the VPN Client or the VPN Server or both to be able to navigate the internet from the VPN Client?

EDIT

My Client config myifwg0.config is this one:

[Interface]
Address = 10.0.1.2/32
PrivateKey = <CLIENT_PRIV_KEY>
DNS = 1.1.1.1

[Peer]
PublicKey = <SERVER_PUB_KEY>
Endpoint = <SERVER_PUBLIC_IP>:51820
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 25

On the Server I made sure the IP forwarding is active by editing /etc/sysctl.conf with net.ipv4.ip_forward=1. Then applying sudo sysctl -p.

On the Server I also made sure some Firewall rules are set as below. The relevant ports/interfaces to WireGuard being 51820 (WG listening), 53 (DNS resolution), eth0 and wg0 being involved in the WireGuard tunnel:

$ sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere                  
443/tcp                    ALLOW       Anywhere                  
51820/udp                  ALLOW       Anywhere                  
53                         ALLOW       Anywhere                  
22/tcp (v6)                ALLOW       Anywhere (v6)             
443/tcp (v6)               ALLOW       Anywhere (v6)             
51820/udp (v6)             ALLOW       Anywhere (v6)             
53 (v6)                    ALLOW       Anywhere (v6)             

Anywhere on eth0           ALLOW FWD   Anywhere on wg0           
Anywhere on wg0            ALLOW FWD   Anywhere on eth0          
Anywhere (v6) on eth0      ALLOW FWD   Anywhere (v6) on wg0      
Anywhere (v6) on wg0       ALLOW FWD   Anywhere (v6) on eth0     

The Server config file at /etc/wireguard/wg0.conf looks like this:

[Interface]
PrivateKey = <SERVER_PRIV_KEY>
Address = 10.0.1.1/24
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
ListenPort = 51820

[Peer]
PublicKey = <CLIENT_PUB_KEY>
AllowedIPs = 10.0.1.2/32

I am wondering if iptables is somehow clashing with ufw. Otherwise I cannot figure out why this WireGuard VPN tunnel shouldn't be working.

2
  • You are routing all traffic from the client to the server. The server is not configured to forward traffic to the Internet. Also, the server needs IP Forwarding enabled in the OS. Apr 6, 2021 at 22:08
  • @JohnHanley I've added more information regarding the content of the config files, kernel settings and firewall rules.
    – TPPZ
    Apr 7, 2021 at 20:23

2 Answers 2

1

Since you are routing all your traffic over the VPN (including DNS) you need to specify a DNS server that you can reach.

For example on your client add the DNS entry:

[Interface]
Address = 10.0.1.2/32
PrivateKey = xxx
DNS = 1.1.1.1

[Peer]
PublicKey = xxx
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = xxx

If this does not work post your configs (without the keys).

2
  • I've specified that DNS field, but still not able to reach the internet. I've updated the question with more information regarding the content of the config files, kernel settings and firewall rules.
    – TPPZ
    Apr 7, 2021 at 20:24
  • IMO your config looks OK. Try to disable ufw and also take a look at your iptables.
    – laktak
    Apr 7, 2021 at 20:59
1

Turns out the problem was somewhere else. I am using Ansible to configure this Server VM and at the end of the configuration process I have to start a SystemD service for WireGuard.

The issue was that the state was set to started, rather than restarted. Which means that when I was running the Ansible script multiple time e.g. to add more configuration like firewall rules and so on, this WireGuard service was never taking into account the new configuration...

This is the correct piece of Ansible script to always restart the SystemD Service for WireGuard on the Server:

  # `systemctl enable wg-quick@wg0`
  - name: REStart WireGuard and enable it on boot
    systemd:
      name: wg-quick@wg0
      enabled: yes
      state: restarted

At this point I doubt this is needed:

      ufw route allow in on wg0 out on eth0
      ufw route allow in on eth0 out on wg0

Given that the iptables settings are already in place in the config file for WireGuard on the Server. But I did not try to remove the ufw rules to see what happens.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.