Wireguard: unable to access services running inside linux guest from internet when vpn connected

Question

I run several services in a linux guest running on vmware on a windows host. Inside the linux guest, I connect the wireguard client to my vpn provider using the following config:

[Interface]
PrivateKey = Redacted
Address = 100.81.66.38/32
DNS = 10.255.255.1

[Peer]
PublicKey = Redacted
AllowedIPs = 0.0.0.0/0
Endpoint = den-301-wg.whiskergalaxy.com:443
PresharedKey = Redacted

On my router, I run a DDNS client so that I always have a friendly name to connect to my services over the web, and I then use port forwards to access my various services (ssh, ftp, etc).

Before connecting my wireguard client, I can access these services from across the internet just fine, but after I wg-quick up wg0 inside my linux guest, I can no longer reach the services from the internet. I am able to still reach them using the local ip address of my linux guest (from the local lan). I just can't seem reach them using the routers public address across the internet.

This seems weird, because I would have though that if I can access things like the ssh server from my local lan, then I though the port forward from the router would have worked as well, since it's pointing to the exact same local ip address. Interestingly enough, I have a similar setup running in another guest except its running Windows. On that one, I can connect the wireguard client, and I can still reach the web services running on that guest through the router's public ip and port forwarding just fine. It's only the linux guest that is doing something different.

I've done things like sysctl -w net.ipv4.ip_forward=1 but it doesn't seem to help. I've also tried AllowedIPs = 0.0.0.0/1, 128.0.0.0/1 but that doesn't change anything either. I can always access them locally, but not over internet. As soon as I disconnect wireguard, everything starts working again.

Answer 1

From you story I read that you have a external VPN provider and you want to connect your linux guest, which is hosting a few services, to that VPN provider. You have also a port forward on you local router that is pointing to that linux guest.

When you enable the tunnel the services that you are hosting on linux guest are not available using the port forward, but they are still internaly.

The problem is due to a routing issue on the linux guest. This is happening because of the line AllowedIPs=0.0.0.0/0.

The line AllowedIPs=0.0.0.0/0 is telling the linux guest that the default route is through the VPN tunnel. This means that all of the incomming internet traffic through the port forward will be answered through the VPN tunnel.

The reason local traffic works is because you are on the same network as your linux guest, so the return traffic knows to which network it should respond to.

As it is not clear to me for what reason you want to enable the Wireguard tunnel, I can't give you a precise answer to what your final solution should look like. But you should change the AllowedIPs to be a more specific network.

For example AllowedIPs=100.81.66.0/24 if you would like to only send packets destinated for the 100.81.66.0/24 network. You can comma separate multiple networks to get your desired route over the VPN