I have set up my home Ubuntu 22.04 server as a wireguard server. I connect to it from a Ubuntu 22.04 laptop wireguard client, from the internet through my home network firewall to the wireguard server, so it appears my laptop is located at home. This setup is made so I can see restricted national contents when I am abroad. National TV is for example too smart to be fooled by a Proton VPN terminated in my home country for some of it's contents.

The wireguard server is configured to route the client wireguard traffic to the internet through one of these iptables rules:

iptables -t nat -A POSTROUTING -s 10.x.x.x/24 -o enp3s0 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 10.x.x.x/24 -o enp3s0 -j SNAT --to-source 10.y.y.y

both work equally fine it seems.

10.x.x.x/24 is the wireguard vpn and 10.y.y.y is the IP address of the outgoing ethernet port enp3s0 connected to my LAN, which has a fixed IP address.

I should mention that I have disabled UFW on both hosts, and checked iptables rules are as expected in accordance with the rules mentioned above, using "iptables-save". And the server is configured for ipv4 forwarding.

My "problem" is primarily an understanding problem, which I hope someone can explain. Now, the whole setup works like a charm as far as I can tell. The client can access resources on the wireguard server when connecting from the Internet through my home firewaall, and internet traffic from the client no longer go directly to the websites, but appear (as indeed desired) to pass through my home wireguard server, to the internet with source IP address being that of my home router/firewall, as seen by whatismyipaddress.com website. Thus, traceroute from the laptop wireguard client to various websites show first hop is the IP address of the wireguard servers wg0 interface, as would be expected if it worked like it should. The "problem" is that I would expect to see heavy iptables traffic from the MASQUERADE/SNAT rules (sudo iptables -L -nv -t nat) when I do - say - play youtube videos on the wireguard client. However, when I compare iptables traffic volume of the MASQUERADE/SNAT rule with the total wireguard server traffic volume, it is only a tiny fraction of the total wireguard traffic volume.

I would have expected that pretty much ALL client wireguard traffic destined for the internet through the server would have to be MASQUERADED with the IP address of the egress enp3s0 ethernet interface of the wireguard servers connected to my home LAN ?

I am quite certain it all works as expected, but I hope someone can explain why the SNAT/MAQUERADE traffic is only a fraction of the total volume ?

1 Answer 1


Sorry to bother the community with my question. After having read the iptables man page I found out that NAT'ing is used only when creating a NEW connection - but NOT for every packet. I guess iptables state machine automatically detect that any subsequent packets should also be NAT'ed.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .