Arch Linux

KeyPercentage9

Member

Registered: 2019-03-24

Posts: 13

Setting wireguard vpn on vps to route traffic to internet

So far I setup a wireguard connection from my arch desktop to my arch vps on gcp.

Desktop setup:

# cat /etc/systemd/network/99-wg0.netdev        
[NetDev]
Name=wg0
Kind=wireguard
Description=Wireguard tunnel wg0

[WireGuard]
PrivateKey=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=

[WireGuardPeer]
PublicKey=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
AllowedIPs=0.0.0.0/0
Endpoint=1.2.3.4:51902 #real vps ip
PersistentKeepalive=25

# cat /etc/systemd/network/99-wg0.network 
[Match]
Name=wg0

[Network]
Address=192.168.35.2/24
Gateway=192.168.35.1

VPS setup:

[root@gcpan1 ~]# cat /etc/wireguard/wg0.conf 
[Interface]
Address = 192.168.35.1/24
ListenPort = 51902
PrivateKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=

[Peer]
PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX=
AllowedIPs = 192.168.35.2/32


[root@gcpan1 ~]# cat /etc/sysctl.d/45-set-router.conf 

net.ipv4.ip_forward=1
[root@gcpan1 ~]# cat /etc/sysctl.d/95-set-router.conf 

net.ipv4.ip_forward=1
[root@gcpan1 ~]# ls /etc/sysctl.d/60-gce-network-security.conf 
/etc/sysctl.d/60-gce-network-security.conf

So far I am able to ssh to my vps using wireguard ip 192.168.35.1 and also ssh back to desk from vps using 192.168.35.2.
I am trying to curl using the wg0 interface  but it is timing out

From my desktop:

# curl --interface wg0 -4 https://ifconfig.co/ip

From my vps:

gcpan1% curl https://ifconfig.co/ip;echo
1.2.3.4 # The real external ip. So external connectivity working fine.

At the end I want to move wg0 in my desktop to a network namespace. But before that I want to first get internet access via wireguard working. I want to have the setup persisted so that I don't have to run the commands on restart.

Slithery

Administrator

From: Norfolk, UK

Registered: 2013-12-01

Posts: 5,776

Re: Setting wireguard vpn on vps to route traffic to internet

You need to configure packet forwarding and NAT on your VPS...
https://wiki.archlinux.org/index.php/Internet_sharing

---

No, it didn't "fix" anything. It just shifted the brokeness one space to the right. - jasonwryan
Closing -- for deletion; Banning -- for muppetry. - jasonwryan

aur - dotfiles

KeyPercentage9

Member

Registered: 2019-03-24

Posts: 13

Re: Setting wireguard vpn on vps to route traffic to internet

Thank you. I did the following and it worked.

sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
sudo iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT

After some research, did the following to persist on reboot.

sudo iptables-save > wgvpn.rules
sudo cp wgvpn.rules /etc/iptables/iptables.rules
sudo systemctl enable --now iptables.service

The file contains the following now

gcpan1% cat /etc/iptables/iptables.rules            
# Generated by iptables-save v1.8.7 on Fri Mar 12 22:51:03 2021
*filter
:INPUT ACCEPT [561:63713]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [385:93718]
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i wg0 -o eth0 -j ACCEPT
COMMIT
# Completed on Fri Mar 12 22:51:03 2021
# Generated by iptables-save v1.8.7 on Fri Mar 12 22:51:03 2021
*nat
:PREROUTING ACCEPT [14:1080]
:INPUT ACCEPT [13:1020]
:OUTPUT ACCEPT [6:632]
:POSTROUTING ACCEPT [1:176]
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT
# Completed on Fri Mar 12 22:51:03 2021

Thank you for the help!

finoderi

Member

Registered: 2020-06-12

Posts: 76

Re: Setting wireguard vpn on vps to route traffic to internet

It would be useful to allow connections to your VPS only from your ISP's subnet. Otherwise it'll be open for all kinds of evil bots trying ssh-logins every minute 24/7.

KeyPercentage9

Member

Registered: 2019-03-24

Posts: 13

Re: Setting wireguard vpn on vps to route traffic to internet

It would be useful to allow connections to your VPS only from your ISP's subnet. Otherwise it'll be open for all kinds of evil bots trying ssh-logins every minute 24/7.

I just changed the ssh port from 22 to a random number and see no login attempts so far.