You are not logged in.

#1 2021-10-14 10:32:08

jfk
Member
Registered: 2017-12-11
Posts: 33

[SOLVED] Wireguard routing issue

On a VPS, I made the following Wireguard configuration:


[Interface]
Address = 10.0.0.1/24
MTU = 1500
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens160 -j MASQUERADE;
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens160 -j MASQUERADE;
ListenPort = 51820
PrivateKey = XXX

[Peer]
PublicKey = XXX
AllowedIPs = 10.0.0.2/32
Endpoint = XXX:38228


which properly mounts the interface (wg0):


1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:bf:9e:7d brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet XXX brd XXX.255 scope global ens160
       valid_lft forever preferred_lft forever
3: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet 10.0.0.1/24 scope global wg0
       valid_lft forever preferred_lft forever


Ping 10.0.0.1 from peer works but no Internet (not DNS-related).

Ipv4 fowarding looks good on the server:

sysctl -a | grep forward
net.ipv4.conf.all.bc_forwarding = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.bc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.ens160.bc_forwarding = 0
net.ipv4.conf.ens160.forwarding = 1
net.ipv4.conf.ens160.mc_forwarding = 0
net.ipv4.conf.lo.bc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.wg0.bc_forwarding = 0
net.ipv4.conf.wg0.forwarding = 1
net.ipv4.conf.wg0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.all.mc_forwarding = 0
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.ens160.forwarding = 0
net.ipv6.conf.ens160.mc_forwarding = 0
net.ipv6.conf.lo.forwarding = 0
net.ipv6.conf.lo.mc_forwarding = 0
net.ipv6.conf.wg0.forwarding = 0
net.ipv6.conf.wg0.mc_forwarding = 0

(n.b. I disabled ufw to put aside a firewall issue).

What am I missing?

I should add  that when I ping ens160 on the server with 8.8.8.8 nothing happens as well (but I can easily sync with pacman for instance). Intuitively I'd say routing is not set correctly regarding that interface but I can't see what it might be.

ip route
default via XXX.1 dev ens160
10.0.0.0/24 dev wg0 proto kernel scope link src 10.0.0.1
10.66.0.0/24 dev ens160 scope link
XXX/24 dev ens160 proto kernel scope link src XXX



SOLVED

My VPS provider was blocking ICMP.

Last edited by jfk (2021-10-15 22:09:00)

Offline

Board footer

Powered by FluxBB