I can't establish VPN connection between AWS EC2 instance and OVH Public Cloud.
In /var/log/syslog there's no errors - just some info about wg-quick operations like adding routing etc.
AWS EC2 instance:
OS: Ubuntu 20.04.2 LTS
Internal IP Address: ex. 10.0.22.22/16 ens4
Public IP Address: ex. 123.123.123.123/32 aws public interface
Port 12345/udp and 12345/tcp opened via Security group
Config:
/etc/wireguard/wg0.conf:
[Interface]
Address = 10.10.0.1/24
SaveConfig = false
PrivateKey = <aws-private-key>
ListenPort = 12345
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o ens4 -j MASQUERADE;
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o ens4 -j MASQUERADE;
[Peer]
PublicKey = <ovh-public-key>
AllowedIPs = 10.10.0.2/24, 192.168.10.0/16
Endpoint = 321.321.321.321:12345
OVH Public Cloud instance:
OS: Ubuntu 21.04
Internal IP Address: ex. 192.168.10.100/16 enp0s2
Public IP Address: ex. 321.321.321.321/32 enp0s1
Port 12345/udp and 12345/tcp opened via ufw
Config:
/etc/wireguard/wg0.conf:
[Interface]
Address = 10.10.0.2/24
SaveConfig = false
PrivateKey = <ovh-private-key>
ListenPort = 12345
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp0s1 -j MASQUERADE;
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s1 -j MASQUERADE;
[Peer]
PublicKey = <aws-public-key>
AllowedIPs = 10.10.0.1/24, 10.0.0.0/16
Endpoint = 123.123.123.123:12345
Both instances:
net.ipv4.ip_forward=1 in /etc/sysctl.conf- command:
wg-quick up /etc/wireguard/wg0.conf
- both are running and have created
wg0 interfaces with IPs from wg0.conf
Summary:
curl to app listening on opened port 80/tcp doesn't work on both sides.
Am I missing something? How can I debug this? I've read several articles, but I can't figure it out.
UPDATE:
Communication is working after modifying /etc/wireguard/wg0.conf:
from AllowedIPs = 10.10.0.x/24, (...) to AllowedIPs = 10.10.0.x/32, (...)
as @Tom Yan suggested.
But I'm struggling with routing.
This is how does it look with pings to other servers that are in the same networks as VPN Servers.
In AWS I added to routing table the rule:
192.168.10.0/16 via AWS-VPN-interface
In OVH-some-instance I ran:
ip route add 10.0.0.0/16 via 192.168.10.100 dev eno4
The summary of pinging:
OVH-VPN -> AWS-VPN OK
OVH-VPN -> AWS-some-instance timeout
OVH-some-instance -> AWS-VPN OK
OVH-some-instance -> AWS-some-instance timeout
AWS-VPN -> OVH-VPN OK
AWS-VPN -> OVH-some-instance OK
AWS-some-instance -> OVH-VPN timeout
AWS-some-instance -> OVH-some-instance timeout
In logs I can see only informations:
$: dmesg -wH
[Jul20 13:40] wireguard: wg0: Receiving keepalive packet from peer 5 (123.123.123.123:12345)
IPTables & Routing
AWS-VPN:
$: iptables-save
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -i wg0 -j ACCEPT
-A FORWARD -o wg0 -j ACCEPT
$: ip route
default via 10.0.22.1 dev ens4 proto dhcp src 10.0.22.22 metric 100
10.0.22.0/19 dev ens4 proto kernel scope link src 10.0.22.22
10.0.22.1 dev ens4 proto dhcp scope link src 10.0.22.22 metric 100
10.10.0.2 dev wg0 scope link
192.168.10.0/16 dev wg0 scope link
### AWS Console Panel rules for AWS-VPN server
Custom TCP TCP 12345 321.321.321.321/32
Custom UDP UDP 12345 321.321.321.321/32
All traffic All All 321.321.321.321/32
All traffic All All 10.0.0.0/16
All traffic All All 192.168.10.0/16
All traffic All All 10.10.0.2/32
OVH-VPN:
$: iptables-save
*filter
:INPUT ACCEPT [26612:55893110]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [34036:3715836]
-A FORWARD -i wg0 -j ACCEPT
-A FORWARD -o wg0 -j ACCEPT
COMMIT
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [69:5450]
-A POSTROUTING -o enp0s1 -j MASQUERADE
COMMIT
$: ip route
default via 321.321.321.1 dev enp0s1 proto dhcp src 321.321.321.321 metric 100
10.0.0.0/16 dev wg0 scope link
321.321.321.1 dev enp0s2 proto dhcp scope link src 321.321.321.321 metric 100
169.254.169.254 via 192.168.10.2 dev enp0s2 proto dhcp src 192.168.10.100 metric 100
10.10.0.1 dev wg0 scope link
192.168.10.0/16 dev enp0s2 proto kernel scope link src 192.168.10.100
$: firewall-cmd --list-all-zones
# I removed empty lines
internal (active)
target: default
icmp-block-inversion: no
interfaces:
sources: 10.0.0.0/16 10.10.0.1/32 123.123.123.123/32
services: dhcpv6-client mdns ssh
ports: 12345/tcp 12345/udp
public (active)
target: default
icmp-block-inversion: no
interfaces:
sources: 123.123.123.123/32
services: dhcpv6-client ssh
ports: 12345/tcp 12345/udp
What else should I do to make it work?
