Join Log in
Score:2
samikroon avatar Server

Wireguard Client IP Identification

mn flag
samikroon

Let's say we have the a Wireguard setup like in the below diagram (see imgur link, couldn't post image without reputation) with the following PostUp & PostDown:

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

https://i.stack.imgur.com/nXEmF.png

Where clients can access our private network through Wireguard (the servers are not Wireguard clients but just have a second network interface which is connected to our private network. In this case if we look at the access logs in services running on our servers, we see that the client IP is the IP address of the Wireguard server (172.16.2.1). This is correct because MASQUERADE is used which replaces the source IP while forwarding. Our preferred outcome would be to see the client IPs in the services running on our servers (i.e. 172.16.2.2 or 172.16.2.3). Is there a manner to set the routing on the Wireguard server in such a way that the source IP is preserved when forwarding requests through Wireguard? So we could possibly block and allow clients based on their client IP in the servers themselves plus have access logs that are traceable to the specific clients?

P.S. I know how to configure the iptables in such a way that access control is arranged from there, but it is not the most preferred solution as there is no way to retrace who did what on the network.

491
0 + 0
Score:0
avatar Server
us flag
Tero Kilkanen

For bi-directional communication to work, the routing has to be configured properly. Details depend on your actual network layout, but principles are the following. I'll use 10.0.8.0/24 as the VPN IP network in the following:

  • Each server needs a route to 10.0.8.0/24 network, where the next hop is specified as 172.16.2.1. If 172.16.2.1 is already the default router, it works fine.

  • Each client needs a route to 172.16.2.0/24 network, where 10.0.8.1 is the next hop (VPN server).

With this configuration, routing is set up properly, and no MASQUERADE is needed.

How to actually set up the routes on the servers and VPN clients are separate questions.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.