3

I’ve recently set up WireGuard on a server using wg-easy (so the config files are generated, not typed out by hand) and I successfully connected a couple of peers, including Linux computers. The last one to set up is my laptop with EndeavourOS and I just can’t figure out why this single device is not able to ping other peers (or reach http services hosted on those peers). Let’s say I’m trying to connect to a PC. The four most important bits (I think):

  1. The ping actually reaches the PC and the PC does respond (verified using tcpdump), but the response is never received by the laptop. I’m no expert but to me it suggests it’s not an issue with the wg config (ip route get PC-IP returns the correct interface).
  2. I disabled firewalld and it still didn’t work (tried looking at the logs before I did that but it also didn’t seem like it was blocking anything). There's no rules in iptables.
  3. The handshake with the server (where wg-easy is set up) works.
  4. I am able to ping the PC via it’s non-WireGuard IP.

I also tried some other common-sense solutions like restarting the interface with wg-quick, rebooting, switching to another network, nothing helps. I’ve no idea what could be the issue here, so any help would be appreciated.

EDIT: Here are the configs of the peers in question:

wg-easy server config:

# Server
[Interface]
PrivateKey = (a key)
Address = 10.8.0.1/24
ListenPort = 51820
PreUp = 
PostUp =  iptables -t nat -A POSTROUTING -s 10.155.129.0/24 -o eth0 -j MASQUERADE; iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; 
PreDown = 
PostDown = 


# Client: PC
[Peer]
PublicKey = (a key)
PresharedKey = (a key)
AllowedIPs = 10.155.129.2/32

# Client: laptop
[Peer]
PublicKey = (a key)
PresharedKey = (a key)
AllowedIPs = 10.155.129.6/32

PC's config:

[Interface]
PrivateKey = (a key)
Address = 10.155.129.2/24
DNS = 1.1.1.1


[Peer]
PublicKey = (a key)
PresharedKey = (a key)
AllowedIPs = 10.155.129.0/24
PersistentKeepalive = 25
Endpoint = (server's public IP):51820

and finally the laptop's config:

[Interface]
PrivateKey = (a key)
Address = 10.155.129.6/24
DNS = 1.1.1.1


[Peer]
PublicKey = (a key)
PresharedKey = (a key)
AllowedIPs = 10.155.129.0/24
PersistentKeepalive = 25
Endpoint = (server's public IP):51820

Thanks!

6
  • 1
    Can you give your wireguard configuration on each node (just obfuscate any key)? This can have to do with the configuration, especially AllowedIPs.
    – A.B
    Commented Jul 9, 2023 at 19:05
  • @A.B I've added the configs. Maybe I'm misunderstanding how AllowedIPs work, but would the ping even reach the other peer if that setting was wrong?
    – Pic
    Commented Jul 10, 2023 at 15:53
  • Sorry that was me: I didn't read thoroughly your question. So, since you can do captures with tcpdump. After the PC's reply, does the server receive it? does it send it back toward the laptop, not back again to the PC? Does the laptop receive it? etc. The routing table on the server could help too: ip route.
    – A.B
    Commented Jul 10, 2023 at 17:05
  • Btw: to figure out where it's sent back, one can capture the UDP envelope traffic in addition to the tunneled traffic.
    – A.B
    Commented Jul 10, 2023 at 17:35
  • Will the traffic actually go through the server? Being completely honest, I haven't dug deep into how WireGuard works, but I thought it only helps make the initial connection but then the peers communicate directly. In any case, I may be doing something wrong, but when pinging between two peers that do work I don't see anything on the server. The command I tried was sudo tcpdump -i ens3 icmp and I went through all the interfaces in ip addr. Was that the correct command?
    – Pic
    Commented Jul 10, 2023 at 17:58

2 Answers 2

4

The connection started working after a few days without my intervention, so I'm unsure of how to solve this, but to not leave this question without some suggestions as to what others can do to find out where is the issue, here are some steps:

  1. Check if the ping reaches the peer. Run the following command on the peer you're trying to ping: sudo tcpdump -tttnei wg0 icmp (where wg0 is the name of the WireGuard interface). If it does, this same command will tell you whether the peer responds to the IP you're expecting: it should be the same IP as in the Address field of the WireGuard conf file of the pinging peer (in my case 10.155.129.6).
  2. Check if the connection passes through the VPN server. Even if you're running wg-easy in docker, you can run tcpdump directly on the host machine: sudo tcpdump -ttttni any 'udp port 51820', where -i any means it listens on all of your interfaces (if, like me, you're unsure through which interface the packets will go through) and 51820 is the port you've bound to 51820 in docker for wg-easy. If you've already got a bunch of peers then you'll probably see quite a bit of noise in there. If possible, you could try disconnecting from the VPN on those other peers while you're debugging.
  3. Double check what is the firewall on your distribution, for EndeavourOS it's firewalld. Make sure it's not blocking your packets.

Good luck!

1

On the wireguard server, add this rule:

sudo iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .