Linux router with traffic forwarding over a wireguard tunnel

Question

I have two location running ArchLinux servers.

1. Remote location is NATed by local ISP's router. ISP over there doesn't provide public IP address so router has the 10.0/16 ip address and there is no way to get the public ip address from ISP.
2. Home location, where again ArchLinux server is running but NATed behind ISP's router. But in this case, ISP provides a public ipv4 address.

I am running wireguard on both servers. Using the public ip address on home location and router's port forwarding capability, remote ArchLinux server can establish a wireguard peer connection to home location.

I have setup a SOCKS5 proxy using SSH command from home location to remote location. Using this SOCKS5 proxy, browsers in my home network can route the traffic to access website and services from remote location. Think it as of geo-unblocking services use case.

Now I want to take it a step further and want to make a my home ArchLinux server a linux router so other devices can forward the traffic via remote location as well.

Home server has only 1 eth port. It has a wifi card, but not connected. I can create a virtual interface for routing, not sure exactly how to do but probably can read the document and do it. My biggest question is how can I create a router from it so I can receive traffic on home server and forward to remote server over wireguard peer tunnel that is already established. I want other devices to access the remote server as well, not just browsers with SOCKS5 proxy support capabilities. I have an old router which I can use to setup a wifi. I wan this router to route traffic via home server --> wireguard tunnel --> remote server.

Answer 1

If you've already set up the WireGuard connection between your home WireGuard server and the remote WireGuard server to send all your home WireGuard server's Internet traffic through it, the WireGuard configuration on the remote server probably looks something like this:

[Interface]
PrivateKey = abc123...
Address = 192.168.95.4/24

# packet forwarding
PreUp = sysctl -w net.ipv4.conf.all.forwarding=1
# packet masquerading
PreUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = def456...
AllowedIPs = 192.168.95.1/32
Endpoint = 203.0.113.2:51820
PersistentKeepalive = 25

And the WireGuard configuration on your home WireGuard server probably looks like this:

[Interface]
PrivateKey = ghi890...
Address = 192.168.95.1/24
ListenPort = 51820

[Peer]
PublicKey = jkl123...
AllowedIPs = 0.0.0.0/0

To enable your home WireGuard server to forward traffic from its LAN through this WireGuard connection, do this:

1. Enable packet forwarding on your home WireGuard server

Run this on your home WireGuard server to enable IPv4 packet forwarding:

sudo sysctl -w net.ipv4.conf.all.forwarding=1

2. Masquerade traffic forwarded from your home WireGuard server

If you're using iptables on your home WireGuard server, and its WireGuard interface is wg0, run this to masquerade packets that are forwarded to its WireGuard interface:

sudo iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE

3. Adjust the firewall on your home WireGuard server

If you're using iptables on your home WireGuard server, and its LAN interface is eth0 and its WireGuard interface is wg0, run this to allow connections to be forwarded from the LAN to the WireGuard interface (and to allow existing connections back through the other way):

sudo iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o wg0 -j ACCEPT

If haven't set up the firewall on your WireGuard server to block any traffic, you don't need this. Check your existing iptables rule set with this command:

sudo iptables-save

Or this command for nftables:

sudo nft list ruleset

4. Route Internet traffic from your home LAN

Either adjust your home router, or the individual devices on your home LAN, to route Internet traffic to your home WireGuard server, using the WireGuard server's LAN IP.

On a Linux device, the command for this would be the following, if the device's LAN interface was eth0, and your home WireGuard server's LAN address was 192.168.1.123:

sudo ip route change default via 192.168.1.123 dev eth0

Note that this and all the above commands only make temporary changes to your system configuration -- they won't survive a system reboot (and if a device is using DHCP, its DHCP client may change its default route back when it renews its DHCP lease). Add them to a script that runs after the system has booted if you want to make them permanent.