I am trying to set up a VPN gateway with two wireguard interfaces.
One being a gateway accessible from the init namespace, which can forward incoming local packets from eth0.
The second interface is for accepting incoming connections for a web-server. And I need this one isolated so it doesn't interfere with the gateway interface.
Looking around I think that using the wireguard namespace trick may work.
This sort of set up
|----------------------------- |
| ------------------ |
| | vpn forward ns | |
| | | |
| | |<--->-macvlan<|---->| |
| |-|--------------| |<->|eht0 ------- Local network, inc gateway.
| | | |
| | init namespace | |
| | | |
| |<->wireguard if | |
| | |
| ------------------ | |
| | vpn inbound ns | | |
| | | | |
| ||<-->-macvlan<--|---->| |
| || | |
| ||<->wireguard if| |
| |----------------| |
|------------------------------|
However the technique on the official docs: https://www.wireguard.com/netns/ won't work, as I need the physical interface available on the LAN to receive local packets to forward.
I also found this answer: https://unix.stackexchange.com/questions/654712/forward-only-lan-traffic-from-network-namespace-to-root-namespace
But it seems incomplete, when I implement something along these lines, the namespace using the macvlan cannot connect to anything, let alone the wireguard connection working.
What I think I need to do for the gateway interface:
Create a namespace & add a macvlan to it. Add default route so everything in this namespace goes through the macvlan and by extension the eth0.
Create the wireguard device in the namespace, then move it to the init namespace. Set the default route for the init namespace to the wireguard interface. So now everything in the init namespace gets routed through the wireguard interface, which in turn will go through the macvlan then through the eth0 and into the wider network?
For the inbound interface:
Same start, but do not move the wireguard interface out of the namespace. I can then run my webserver in this namespace and inbound connections via wireguard will connect to it.
I don't fully understand how the macvlan works. Is it purely an alias for the linked physical device? so anything routed down it is in fact just being routed down say eth0? Do i need to give it an ip address? If so, does it need to be on the same subnet as my internet gateway in order to reach the wider internet?
Is there a better way to achieve what I am trying to do?
