Wireguard VPN Routing

LupusE · 2022-06-16T13:48:24.745Z

MapGuy11:

I use the PIVPN script to set it up.

Yeah. Big issue, here at my side.
I’ve used some script → Worked.
Now I am about to set it up by myself, and I am learning new things, every day.

The main issue with most scripts I’ve see: they are outdated. Some of them got some Wrapper around, so it seems to work.

I think it is an issue with the routing (take a look in PostUp and PostDown in /etc/wireguard/wg0.conf). Yesterday I’ve learned iptables is now nftables since Debian 10. I’m still about to understand writing the rules.
I got a connection, but no traffic will be routed. Maybe at the end of this week I can tell more

edit: I’ve used the linked script at ubuntu/jammy. My own Server is a Debian 11.3 … I do think this is also a reason why it is harder to archive.

MapGuy11 · 2022-06-16T13:49:36.524Z

Yeah I know I used a script so bad of me! let me look at those and I will report back.

MapGuy11 · 2022-06-16T13:50:58.228Z

Ok, I see there is no routing at all listed under Interface.

MapGuy11 · 2022-06-16T15:17:18.372Z

Under the Interface tab I added these two lines:

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

MapGuy11 · 2022-06-16T15:17:54.532Z

I assume that will add my routing so now I have to figure out how to have that route through the Opal router and hit the device connected to it.

LupusE · 2022-06-16T15:21:04.719Z

It could be helpful to know on what OS do you install the server. Debian is behaving a little different than ubuntu. I would say ubuntu is easier to start, but Debian is much clearer to analyse.
It even works virtualized as LXC, just mount the /dev/net/tun from the host in the container.

I found my error. Okay, some errors. Here is the actual working Configuration:

root@walter01:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:51820

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.7.0.0/24          anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@walter01:~# ip r
default via 192.168.21.1 dev eth0 onlink 
10.7.0.0/24 dev wg0 proto kernel scope link src 10.7.0.1 
192.168.21.0/24 dev eth0 proto kernel scope link src 192.168.21.51

192.168.21.0/24 is my home net
192.168.21.51 is my WireGuard ‘Server’

The server configuration

root@walter01:~# cat /etc/wireguard/wg0.conf 
# Do not alter the commented lines
# They are used by wireguard-install
# ENDPOINT vpn.mydomain.net

[Interface]
Address = 10.7.0.1/24, fddd:2c4:2c4:2c4::1/64
PrivateKey = UGHxxxxx
ListenPort = 51820

# BEGIN_PEER amy
[Peer]
PublicKey = hI8xxxxx
PresharedKey = Ew7xxxxx
AllowedIPs = 10.7.0.2/32, fddd:2c4:2c4:2c4::2/128
# END_PEER amy

The client configuration

root@walter01:~# cat amy.conf 
[Interface]
Address = 10.7.0.2/24, fddd:2c4:2c4:2c4::2/64
DNS = 192.168.21.53
PrivateKey = 4P8xxxxxx

[Peer]
PublicKey = UlExxxxxx
PresharedKey = Ew7xxxxxx
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = vpn.mydomain.net:51820
PersistentKeepalive = 25

192.168.21.53 is my own DNS (PiHole).

As far as I understand, the AllowedIPs = 0.0.0.0/0 will send all traffic over the tunnel. So I don’t need to specify my network.
If you’d like to have the normal traffic over the normal net and only your site, you can specify a host or net, here.

Now I will rewrite the iptbales rules to nftables …

MapGuy11 · 2022-06-16T15:23:46.157Z

Sorry, I missed that point it’s an LXC Container of Ubuntu Server 20.04 LTS. Let me check on this.

LupusE · 2022-06-16T15:26:36.628Z

MapGuy11:

iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

If you put this line just in the shell, does it work? Maybe one by one:

:~# iptables -A FORWARD -i wg0 -j ACCEPT
:~# iptables -A FORWARD -o wg0 -j ACCEPT
:~# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

(wg0 should exist, see ip a)

It was the first time I was starting to wonder about iptables/nftables, there where some errors.

MapGuy11 · 2022-06-16T15:27:19.583Z

Yeah currently I have absolutely no routes so let me try this.

LupusE · 2022-06-16T15:28:30.671Z

is /dev/net/tun available on the ubuntu contianer? (host in the first edit was wrong)

MapGuy11 · 2022-06-16T15:31:04.449Z

LupusE:

/dev/net/tun

oddly no it isn’t available

EDIT: But doesn’t that only pertain to OpenVPN?

LupusE · 2022-06-16T15:35:11.339Z

https://pve.proxmox.com/wiki/OpenVPN_in_LXC
This howto helped me a lot. Should even works without proxmox.

Stop container.

Search for the [container].conf (f.ex. /etc/pve/lxc/123.conf)

add:

lxc.cgroup2.devices.allow: c 10:200 rwm
lxc.mount.entry: /dev/net dev/net none bind,create=dir

allow access to the file at the host:
:~# chown 100000:100000 /dev/net/tun

Start container.

I’m not sure if /dev/net/tun was available in side the container or if I needed to create it

:~# mkdir -p /dev/net
:~# touch /dev/net/tun

LupusE · 2022-06-16T15:36:00.636Z

MapGuy11:

But doesn’t that only pertain to OpenVPN?

I can’t answer this in detail, now. I only know before it doesn’t work for me, afterwards it worked …

Edit: Maybe the TUN device is linked to the BoringTun from https://raw.githubusercontent.com/Nyr/wireguard-install/master/wireguard-install.sh …

MapGuy11 · 2022-06-16T15:36:11.688Z

On a different note if I redid everything and got everything routed how would I allow a device behind the Opal router (it’s connected with VPN policies so only that device can use the VPN) to be port forwarded through?

Example: User → Server Hosting VPN tunnel → VPN Tunnel → Opal Router → Device that needs to be accessed

EDIT: I have to edit posts now since I am a new user I can’t reply anymore.

alzhao · 2022-06-17T07:22:40.566Z

Did some testing:

Wireguard, does not support a mesh setup by default, i.e. let the client ping each other. To achieve, need to let the clients knows each other by the public key. This is achieve in our GoodCloud S2S solution.

Openvpn should be fine.

MapGuy11 · 2022-06-17T12:43:34.929Z

Yeah, I can’t use the GoodCloud S2S as I can’t forward any ports on one side. I wish I could but I can’t

MapGuy11 · 2022-06-17T12:45:10.353Z

So If I changed to OpenVPN how would I port forward a device to go through the firewall and be accessed on the OpenVPN connection?

Example: User → Server Hosting VPN tunnel → VPN Tunnel → Opal Router → Device that needs to be accessed

MapGuy11 · 2022-06-18T01:39:54.263Z

Hello? I will close this I just need this one question above answered. Thanks for all of your time and support!

alzhao · 2022-06-20T06:45:57.367Z

MapGuy11:

So If I changed to OpenVPN how would I port forward a device to go through the firewall and be accessed on the OpenVPN connection?

After you set up openvpn, you should be able to access each node using the vpn IP address, e.g. 10.10.0.x
Then you set up port forward in each router. From vpn zone to the client IP. Example like below

image1671×607 36.5 KB

MapGuy11 · 2022-06-20T12:56:09.312Z

Perfect! Thank you so much since this is a remote install I will have to wait to try it out so I will just close this in the meantime.

Again I thank you for all of your work and support and I have to say your router remotely is working very well!