Score:0

Server

IP Routing Questions (Wireguard as Company Network, Hetzner Private Network as Server Private Network)

germebl

6/16/24, 11:48 AM

(educational purposes)

Hey Guys,

actually i'm trying to create a company network (employee clients) with wireguard. Lets say its the subnet 10.0.0.0/24. The Wireguard Server is a Hetzner Cloud server, which has surely a public ip address (to be reachable for the clients to build up the internal network) and further its connected to a Hetzner private network (Layer 2) - Lets say its 192.168.0.0/24 (on ens10 interface).

How can i get access from a employee client which is connected to the wireguard vpn and has the wireguard ip address 10.0.0.2/24 to all servers which are within 192.168.0.0/24?

I tried to create a mostly correct diagram of it

I show you my practice:

client tunnel file:

[Interface]
PrivateKey = <CLIENTS-PRIVATE-KEY>
Address = 10.0.0.2/32

[Peer]
PublicKey = <SERVERS-PUBLIC-KEY>
AllowedIPs = 192.168.0.0/24, 10.0.0.0/24
Endpoint = <SERVERS-PUBLIC-IP>:51820

servers tunnel file:

[Interface]
Address = 10.0.0.1/32
ListenPort = 51820
PrivateKey = <SERVERS-PRIVATE-KEY>

[Peer]
PublicKey = <CLIENTS-PUBLIC-KEY>
AllowedIPs = 192.168.0.0/24, 10.0.0.0/24

also i enabled net.ip4.ip_forward within the vpn server to forward requests to the 192.168.0.0/24 subnet.

My client is able to resolve his own Wireguard IP (10.0.0.2), resolve Wireguard IP of VPN server (10.0.0.1) and further is able to resolve the private ip address of the VPN server (192.168.0.2) - but is not able to resolve other hosts within the private network like 192.168.0.3/192.168.0.4 etc.

Maybe you can help me to figure out what i'm doing wrong or whats missing?

139

1 + 0

networking

linux

vpn

routing

wireguard

Score:0

Server

captainmish

6/16/24, 2:35 PM

Sounds like you're almost there, but the servers in the 192 network will need to know how to reply to requests. By default they will get a packet from the wireguard client, but reply to it via their default route, which looks like it is not your vpn server.

To do this, add a route back to the 10.0.0.0/24 net to all of the 192 servers, eg run this on 192.168.0.3:

sudo ip route add 10.0.0.0/24 via 192.168.0.2

Now these servers will know how to route back to the 10.0.0.0/24 network instead of just throwing it at their default route :)

+ 5

germebl

6/16/24, 4:32 PM

Sounds like i thought - when i do this i get the message "Error: Nexthop has invalid gateway".

germebl

6/16/24, 4:43 PM

I also tried to `ip route add 10.0.0.0/24 via 192.168.0.2 dev ens10` but still the same issue.

captainmish

6/17/24, 6:30 PM

This needs to be on the box with ip 192.168.0.3 (or 4), the ones inside the 192.168.0.x private network, it looks like you're doing it on a different box that doesnt have a 192.168.0.x address

germebl

6/17/24, 9:46 PM

`ens10: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc fq_codel state UP group default qlen 1000 link/ether 86:00:00:4c:0a:a5 brd ff:ff:ff:ff:ff:ff altname enp0s10 inet 192.168.0.9/32 brd 192.168.0.9 scope global dynamic ens10 valid_lft 55362sec preferred_lft 55362sec` Its a Debian 12. So yeah, its surely have a ip of the 192.168.0.0/24 subnet.

captainmish

6/19/24, 9:38 AM

192.168.0.9/32 is your issue - you have a network of size "1", you'll want that to be /24 so that it can reach other IPs - this is why you're getting the error, the gateway needs to be on the same network as the host

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: IP Routing Questions (Wireguard as Company Network, Hetzner Private Network as Server Private Network)

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.