I run several services in a linux guest running on vmware on a windows host. Inside the linux guest, I connect the wireguard client to my vpn provider using the following config:

PrivateKey = Redacted
Address =

PublicKey = Redacted
AllowedIPs =
Endpoint = den-301-wg.whiskergalaxy.com:443
PresharedKey = Redacted

On my router, I run a DDNS client so that I always have a friendly name to connect to my services over the web, and I then use port forwards to access my various services (ssh, ftp, etc).

Before connecting my wireguard client, I can access these services from across the internet just fine, but after I wg-quick up wg0 inside my linux guest, I can no longer reach the services from the internet. I am able to still reach them using the local ip address of my linux guest (from the local lan). I just can't seem reach them using the routers public address across the internet.

This seems weird, because I would have though that if I can access things like the ssh server from my local lan, then I though the port forward from the router would have worked as well, since it's pointing to the exact same local ip address. Interestingly enough, I have a similar setup running in another guest except its running Windows. On that one, I can connect the wireguard client, and I can still reach the web services running on that guest through the router's public ip and port forwarding just fine. It's only the linux guest that is doing something different.

I've done things like sysctl -w net.ipv4.ip_forward=1 but it doesn't seem to help. I've also tried AllowedIPs =, but that doesn't change anything either. I can always access them locally, but not over internet. As soon as I disconnect wireguard, everything starts working again.

1 Answer 1


From you story I read that you have a external VPN provider and you want to connect your linux guest, which is hosting a few services, to that VPN provider. You have also a port forward on you local router that is pointing to that linux guest.

When you enable the tunnel the services that you are hosting on linux guest are not available using the port forward, but they are still internaly.

The problem is due to a routing issue on the linux guest. This is happening because of the line AllowedIPs=

The line AllowedIPs= is telling the linux guest that the default route is through the VPN tunnel. This means that all of the incomming internet traffic through the port forward will be answered through the VPN tunnel.

The reason local traffic works is because you are on the same network as your linux guest, so the return traffic knows to which network it should respond to.

As it is not clear to me for what reason you want to enable the Wireguard tunnel, I can't give you a precise answer to what your final solution should look like. But you should change the AllowedIPs to be a more specific network.

For example AllowedIPs= if you would like to only send packets destinated for the network. You can comma separate multiple networks to get your desired route over the VPN

  • Let me try to clarify. I'm not actually trying to reach any particular place from the linux guest which is running wireguard. Instead, I am trying to retain access to the linux guest from other machines on my network. The problem is that as soon as I start the vpn inside my linux guest, I lose access to that machine from the local network. I want to be able to still ssh into that guest from the local network, even though it is connected to an outside vpn. Commented Jun 12, 2022 at 22:25
  • Could you please update your original question? In the original question you are saying that: "I can no longer reach the services from the internet. I am able to still reach them using the local ip address of my linux guest (from the local lan)." But now you are saying that you lose access to the machine from the local network. In the end it would be more than likely to be a routing issue that I'm more than happy to help you solve.
    – Mr. Diba
    Commented Jun 13, 2022 at 6:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .