1

I need some of the clients to have access to the internet when connected through the wireguard, and some only see the local network for access to samba, but without access to the Internet. I have Centos with standard settings that I took from the Internet

wg0.conf

[Interface]
Address = 10.8.0.1/24
PrivateKey = SERVER_PRIVATE_KEY
ListenPort = 35053

[Peer]
PublicKey = CLIENT_PUBLIC_KEY
AllowedIPs = 10.8.0.2/32

To get internet access for a client that connects to the wireguard, I do the following

vim /etc/sysctl.conf 
net.ipv4.ip_forward = 1
sysctl -p


firewall-cmd --permanent --zone=public --add-port=35053/udp
firewall-cmd --permanent --zone=public --add-masquerade
firewall-cmd --reload

I add this on the client and everything works fine, I connect to the server and the client has the internet, it also has access to the server's local network and samba

client.conf

[Interface]
PrivateKey = CLIENT+PRIVATE_KEY
Address = 10.8.0.2/24
DNS = 1.1.1.1

[Peer]
PublicKey = SERVER_PUBLIC_KEY
AllowedIPs = 0.0.0.0/0
Endpoint = SERVER_IP:35053
PersistentKeepalive = 20

How can I add another client so that he has access to the local network and samba, but does not have access to the internet through masquerading?

I tried to add another wireguard interface wg2 that would only work on the local network. This does not work, because the public zone already has masquerading and it is being applied to wg2. You can buy another external IP then it will work, but maybe there are some other solutions?

1 Answer 1

3

Take a look here: https://unix.stackexchange.com/a/714015/537971

Basically, on server side you need to add your LAN CIDR to AllowedIPs = 10.8.0.2/32 for example: AllowedIPs = 10.8.0.2/32, 192.168.1.0/24.

I tried to add another wireguard interface wg2 that would only work on the local network. This does not work, because the public zone already has masquerading and it is being applied to wg2.

The second Wireguard instance should have different CIDR like 10.9.0.0/24 and the masquerade should be configured for one CIDR and Interface only, iptables example: iptables -t nat -A POSTROUTING -s 10.0.0.0/24 -j MASQUERADE or iptables -t nat -A POSTROUTING -i wg0 -o eth0 -j MASQUERADE You should try mimic this behavior on firewalld or get rid of it on such setup with complex requirements.

2
  • Have you tried doing this in Rocky Linux 9? Aug 19, 2022 at 0:28
  • No, but distribution matters less than we think it does. Here's a guide if you want to try using iptables/nftables: thegeekdiary.com/… I skimmed through firewalld docs and it seems to support less features than iptables.
    – bdzkv
    Aug 19, 2022 at 8:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .