1

I am desperately trying to get my Wireguard-VPN-Setup up and running as my Internet Connection has been switched to IPV6 (DS-lite).

My Setup(raw):

  • NetCup VPS (acting as IPv4 contact point for my mobile devices out of the Internet)
  • Internal Wireguard Server (acting as the Gateway between internal and external network)
  • Iphone with Wireguard Client installed connected via mobile network only

Current Status:

  • VPN Tunnel up and running between VPS and internal Wireguard Server as well as VPS and Mobile Client
  • VPS (VPN Address 192.168.1.10) able to ping both peers (192.168.1.1 and 192.168.1.15)
  • Internal Wireguard Server(192.168.1.1) able to ping VPS (192.168.1.10) but not able to reach Mobile Client (192.168.1.15) --> ICMP: Destination Host unreachable.
  • tcpdump on VPS Server does not show any ICMP-Request coming in from my internal Wireguard Server when trying to ping 192.168.1.15
  • Mobile Client (192.168.1.15) able to ping VPS (192.168.1.10) via VPN-Tunnel but not able to reach Internal Wireguard Server (192.168.1.1)

For me it seems to be a routing issue on the internal Gateway Server. Routes are set by wg-quick as follows:

default via 192.168.2.1 dev enp0s10 proto static metric 100 169.254.0.0/16 dev enp0s10 scope link metric 1000 192.168.1.0/24 dev wg0 proto kernel scope link src 192.168.1.1 192.168.2.0/24 dev enp0s10 proto kernel scope link src 192.168.2.2 metric 100

IP-Forwarding is active.

Any Ideas on what I could have missed?

Any assistance is well appreciated!

5
  • Are you sure that ip forwarding is active for the wireguard interface? Any firewall iptables/nftables rules involved? Commented Aug 31, 2021 at 9:47
  • Also please provide wireguard configuration for all machines involved. The routes on the other machines would also be useful, but assuming they are set up by wg-quick, you can leave those out. Commented Aug 31, 2021 at 10:05
  • Thanks for your quick replies! I found the solution in the meantime. I have added the details to the original posting.
    – Andi
    Commented Aug 31, 2021 at 21:29
  • You can answer your own question: it is better to keep the answer separate. Commented Aug 31, 2021 at 21:30
  • Welcome to Unix & Linux! I rolled back your recent edit tagging the title with "SOLVED". If you have a solution, then consider adding that solution as a separate answer and accept it later. Accepting an answer will mark the question as resolved. Please see unix.stackexchange.com/help/self-answer
    – Kusalananda
    Commented Aug 31, 2021 at 21:35

1 Answer 1

0

This is a solution initially posted as an edit in the question. Posted here (with grammatical fixes) as a community wiki answer as the original author did not do so themselves.


After another couple of hours of searching, I finally found a solution that did the trick for me.

The failed ICMP ping message (192.168.1.1 to 192.168.1.15) provided a key hint to find the solution. Besides stating that the destination was not reachable, it also stated:

sendmsg: Destination Address required

This message was provided by Wireguard.

The missing endpoint definition for the peer entries made for the two VPN clients in their corresponding wg0.conf-files was the source of this error.

Solution:

  1. Removed the peer definitions for the clients initially meant to know each other directly. They don't work because the direct endpoints between VPN-Clients are not defined. This is where the ICMP message came from.

  2. Added concrete peer addresses into the remaining peer definition which point to the Wireguard server, 192.168.1.10/32 for the server itself and 192.168.1.15/32 for the client (and vice versa for the other client).

  3. Added a firewall rule to the FORWARD chain which allows packet forwarding between wg0 as in and as outgoing device. In the first instance, I created specific traffic rules between the internal and VPN interface (in both directions). I'm not sure if this really had an effect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .