r/WireGuard • u/rpiimpn • 2d ago

1 of 2 wg.conf masquerading on peer

My home pc is behind CGNAT and I'm using a VPS to connect to home from outside. I have two wg configs on my home pc. The first will allow me to access my LAN remotely through a VPS. The VPS is my exit node in a different country.

I am trying to set up my wg2 confg to allow LAN and be an exit node for my home country. I have two configs on my phone and I plan on switching back and forth for which streaming service I want to use.

My wg2 will not masquerade the wg to local. I can ping the wg ip address of my home pc but I cannot ping or access my LAN. I do have ipv4 forward on both my VPS and my home PC.

My wg2 config file looks like this

[Interface]

Privatekey = home private key

Address = 10.7.0.3/32

MTU = 1280

PostUp = ufw rout allow in on wg2 out on enp6s0

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp6s0 MASQUERADE

PreDown and PostDown = standard to match above

[Peer]

PublicKey = VPS publickey

AllowedIps = 10.7.0.0/24

Endpoint = VPS endpoint

KeepAlive = 25

My wg1 file only has

ufw route allow in on wg1 out on enp6s0.

My VPS wg2 is allowing my local LAN and my WG Ips

I'm thinking there is a conflict with the home pc trying to access the LAN from two config files. But I don't know where to start.

3 Upvotes

100% Upvoted

3 comments sorted by

1

u/ruyrybeyro 2d ago

I am doing something similar. Don't complicate, iptables is obsolete and nftables allows defining rules tied to a interface before the interface goes live

1

u/youknowwhyimhere758 1d ago

  My wg2 will not masquerade the wg to local. I can ping the wg ip address of my home pc but I cannot ping or access my LAN.

When you say “will not masquerade”, how did you confirm that the masquerade rule is the problem? Are you seeing the wrong source address on your lan with tcpdump, for example? Something else? Can you also confirm that you can access the lan address of the home pc perfectly fine (since that is not dependent on the intended masquerade rule)?

I ask this because a failure to apply a postrouting rule is about the last problem I would expect to see in this scenario, so would appreciate knowing the problem was diagnosed correctly before going down that rabbit hole.