Join Log in
Score:0
Kevin avatar Server

Sent WG trafic to eth1

se flag
Kevin

I setup a wireguard server with AWS, setup the wireguard client with a raspberry PI.

Now I need to redirect the WG traffic (wg0) to eth1 (eth0 is the uplink to my switch)

-- my goal is to get a IP from my WG server when a client is connected to the PI eth1 (Full tunnel)

my WG config

[Interface]
Address = 10.1.1.1/24
ListenPort = 51820
PrivateKey = ##
PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = ##
AllowedIPs = 10.1.1.2/32

I installed Netplan but I'm very lost with the config (I need to sent WG0 traffic to ETH1)

does the follow config make sense : (probably not...)

network:
    version: 2
    renderer: networkd
    bonds:
        bond0:
            dhcp4: yes
            interfaces:
                - wg0
                - eth1
            parameters:
                primary: wg0



It's would be even better for the Raspberry PI to joint my UniFi VLAN (uplink) and get an IP from there but still sent/receive all the traffic from WG server but that's to complex for me I guess

UPDATE: should I add the WG config to Netplan?

tunnels:
network:
    version: 2
    renderer: networkd
    bonds:
        bond0:
            dhcp4: yes
            interfaces:
                - wg0
                - eth1
            parameters:
                primary: wg0
  wg0:
    mode: wireguard
    addresses: 10.1.1.1/24
    peers:
      - keys:
         Public_key?
        ...
    key: Private_key?
43
0 + 0
vpn
Tom Yan avatar
in flag
Tom Yan
So basically you want the Pi to act like a VPN router in which case eth1 is the LAN interface and wg0 is the WAN interface, is that correct?
0
Reply
Kevin avatar
se flag
Kevin
Yes that's what I'm desperately try to accomplish. ETH0 is connected to my switch (so WAN), WG0 Is connecting to my AWS WG server and I want whatever devices connected in ETH1 (LAN) to go to WG0 (full tunnel) and get an IP from AWS
0
Reply
Score:1
Tom Yan avatar Server
in flag
Tom Yan

First of all bond has nothing to do with that, and basically, the drill is to make use of an ip rule, which looks up another route table (that consists of a default route with dev wg0) for all the traffics from eth1.

ip route add default dev wg0 table 123
ip rule add iif eth1 lookup 123

(The number 123 is arbitrary. You'll need to refine them if you e.g. want the eth1 hosts to be able to reach the eth0 hosts.)

Certainly IP forwarding needs to be enabled (sysctl) and allowed (firewall, if any) as well.

Then you decide whether you want to masquerade/NAT for the eth1 IP subnet, or add a return route for it on the wireguard server. The latter is recommended when possible, and one of the reasons is that you'll need to masquerade/NAT on wireguard server anyway (for either 10.1.1.2 or the eth1 IP subnet), assuming you want to use one of its interface for Internet connection. (The number of layers of NAT should be kept to the minimal.)

(I'm assuming 10.1.1.2 is the WG IP on the Pi. It's unclear which conf you have shown.)

Make sure the eth1 IP subnet does not conflict with any that is used on the wireguard server, if you choose not to NAT for it on the Pi. Also the subnet needs to be added to AllowIPs= on the wireguard server in that case.

Most likely you should use the PostUp= for the aforementioned setup, as I'm not sure if netplan has a way for you to specifiy it. (The added route should be gone when wg0 is gone, so you only need to delete the ip rule with Pre/PostDown=.)

EDIT: You should probably use Table=off on the client conf, unless you want the Pi's own traffics to go into the tunnel as well.

0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.