0

I have a Linux VPS that I am using as a gateway to the internet for two sites using iptables and Wireguard VPN Tunnels. While internet access throught the VPS from the both sites is working, I am unable to access Site A from Site B and vice versa. The current config is:

VPS:
wg0 - 10.10.0.0/31 (----> Site A wg0 10.10.0.1/31)
wg1 - 10.20.0.0/31 (----> Site B wg0 10.20.0.1/31)
eth0 - Internet (public IP)

Site A Router:
wg0 - 10.10.0.1/31 (----> VPS wg0 10.10.0.0/31)
eth0 - 172.16.10.0/24 (local lan)
eth1 - Internet (carrier grade NAT)

Site B Router:
wg0 - 10.20.0.1/31 (---- > VPS wg1 10.20.0.0/31)
eth0 - 172.16.20.0/24 (local lan)
eth1 - Internet (carrier grade NAT)

VPS wg0.conf:

[Interface]
Address = 10.10.0.0/31
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ListenPort = 60174
PostUp = iptables -A FORWARD -i eth0 -o wg0 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i eth0 -o wg0 -j ACCEPT; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# BEGIN_PEER SITE A
[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PresharedKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AllowedIPs = 10.10.0.0/31, 172.16.10.0/24
# END_PEER SITE A

VPS wg1.conf:

[Interface]
Address = 10.20.0.0/31
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ListenPort = 60175
PostUp = iptables -A FORWARD -i eth0 -o wg1 -j ACCEPT; iptables -A FORWARD -i wg1 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i eth0 -o wg1 -j ACCEPT; iptables -D FORWARD -i wg1 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# BEGIN_PEER SITE B
[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PresharedKey = Exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AllowedIPs = 10.20.0.0/31, 172.16.20.0/24
# END_PEER SITE B

VPS iptables config:

# Generated by iptables-save v1.8.7 
*filter
:INPUT DROP [215:23625]
:FORWARD DROP [21:1140]
:OUTPUT ACCEPT [20568:6762867]
-A INPUT -p udp -m udp --dport 60174 -j ACCEPT
-A INPUT -p udp -m udp --dport 60175 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o wg1 -j ACCEPT
-A FORWARD -i eth0 -o wg0 -j ACCEPT
-A FORWARD -i wg1 -j ACCEPT
-A FORWARD -i wg0 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
COMMIT
# Completed on 
# Generated by iptables-save v1.8.7 
*nat
:PREROUTING ACCEPT [2094:151039]
:INPUT ACCEPT [7:501]
:OUTPUT ACCEPT [12:841]
:POSTROUTING ACCEPT [870:73441]
-A POSTROUTING -o eth0 -j MASQUERADE

Site A wg0.conf:

[Interface]
Address = 10.10.0.1/31
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# BEGIN_PEER VPS
[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PresharedKey = Exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AllowedIPs = 0.0.0.0/0

Site B wg0.conf:

[Interface]
Address = 10.20.0.1/31
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# BEGIN_PEER VPS
[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PresharedKey = Exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AllowedIPs = 0.0.0.0/0

IP forwarding is enabled on the VPS.

I can ping from Site A to wg1 on the VPS (10.20.0.0), but I can not ping the other end of the Site B tunnel (10.20.0.1) or anything on the LAN of Site B. The same in reverse : I can ping from Site B to wg0 on the VPS (10.10.0.0), but I can not ping the other end of the Site A tunnel (10.10.0.1) or anything on the LAN of Site A. I currenly have the firewalls totally open on the wg interfaces for testing, so I know it's not being blocked, it's a routing problem. From the VPS itself, I can ping the other end of both tunnels and the LAN on boths sites. It just appears to be routing between the VPS wg interfaces that is the problem.

The wg0.conf for allowed IPs for on the VPS include 172.16.10.0/24 and 10.10.0.1/31, so I cannot also set them as allowed in the wg1.conf and vice versa.

All the other guides I have seen are for Wireguard peers that are single hosts, rather that the peer being a router for another network.

I'm guessing it's the allowed IPs that is breaking things, but not sure. My guesses to fix it are something simple like NAT between the wg interfaces on the VPS, using the FwMark tag somehow, using different routing tables, or putting the wg interfaces into different network namespaces, but I'm not sure what is the best avenue to go down.

2 Answers 2

0

You probably just need to add a PersistentKeepalive setting to the WireGuard config on your Site A and B routers:

[Interface]
Address = 10.10.0.1/31
PrivateKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# BEGIN_PEER VPS
[Peer]
PublicKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
PresharedKey = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AllowedIPs = 0.0.0.0/0
Endpoint = vps.example.com:60174
PersistentKeepalive = 25

This will cause WireGuard to send a keepalive packet from the router to your VPS every 25 seconds, keeping open the connection through the CGNAT between the router and the VPS, allowing the VPS to send traffic the other way.

0

Turns out I was overthinking things and making it more complex than necessary.

I did not need 2 wg interfaces on the VPS. I reduced it to 1, configured both sites as peers and added the relevant allowed networks to each peer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .