Wireguard no internet access
reddit / selfhosted

----------------------------------------------------------------------
Regis_DeVallis · 2023-12-12 23:35

I can connect to the VPN just fine from anywhere, but I cannot access
the internet for the life of me. I want to use it as a VPN. I feel
like I'm just missing something really dumb that isn't letting me get
it working all the way.

I host it in a docker swarm, on my main mode. Here's my compose file:

```yaml
version: "3.8"

services:
  wg-easy:
    environment:
      # ⚠️ Required:
      # Change this to your host's public address
      WG_HOST: something.domain
      PASSWORD: ${PASSWORD}

      # Optional:
      # - PASSWORD=foobar123
      # - WG_PORT=51820
      # - WG_DEFAULT_ADDRESS=10.8.0.x
      # - WG_DEFAULT_DNS=1.1.1.1
      # - WG_MTU=1420
      # - WG_ALLOWED_IPS=192.168.15.0/24, 10.0.1.0/24
      # - WG_PRE_UP=echo "Pre Up" > /etc/wireguard/pre-up.txt
      # - WG_POST_UP=echo "Post Up" > /etc/wireguard/post-up.txt
      # - WG_PRE_DOWN=echo "Pre Down" > /etc/wireguard/pre-down.txt
      # - WG_POST_DOWN=echo "Post Down" > /etc/wireguard/post-down.txt

    image: weejewel/wg-easy
    container_name: wg-easy
    volumes:
      - config:/etc/wireguard
    # ports:
    # - "51820:51820/udp"
    # - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    networks:
      - traefik-public
    deploy:
      placement:
        constraints:
          - node.role == manager
      labels:
        - traefik.enable=true
        - traefik.docker.network=traefik-public
        - traefik.constraint-label=traefik-public

        ## UDP Routers
        - traefik.udp.routers.wireguard-udp.entrypoints=wireguard

        ## UDP Services
        - traefik.udp.routers.wireguard-udp.service=wireguard-udp-svc
        - traefik.udp.services.wireguard-udp-
svc.loadbalancer.server.port=51820

        ## UI
        - traefik.http.routers.wireguard-ui-
http.rule=Host(`something.domain `)
        - traefik.http.routers.wireguard-ui-http.entrypoints=http
        - traefik.http.routers.wireguard-ui-http.middlewares=https-
redirect
        - traefik.http.routers.wireguard-ui-
https.rule=Host(`something.domain`)
        - traefik.http.routers.wireguard-ui-https.entrypoints=https
        - traefik.http.routers.wireguard-ui-https.tls=true
        - traefik.http.routers.wireguard-ui-https.tls.certresolver=le
        - traefik.http.services.wireguard-
ui.loadbalancer.server.port=51821

volumes:
  config:

networks:
  traefik-public:
    external: true
```

And my config:
```conf
# Server
[Interface]
PrivateKey = some key
Address = 10.8.0.1/24
ListenPort = 51820
PreUp =
PostUp =  iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j
MASQUERADE; iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT;
iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j
ACCEPT;
PreDown =
PostDown =


# Client: my client (36b2ad59-2e43-4fbc-80c1-fec74f5c03a8)
[Peer]
PublicKey = some key
PresharedKey = some key
AllowedIPs = 10.8.0.2/32
```

----------------------------------------------------------------------
SahSon · 2023-12-13 00:26

When you say "anywhere" do you mean outside your LAN?

What changes have you made in your router to allow WG through it?

----------------------------------------------------------------------
Regis_DeVallis · 2023-12-13 00:48

Just a port forward . Do I need to make any more changes beyond that?
Like I said I can connect just fine, I just can't connect to websites
outside of my LAN.

----------------------------------------------------------------------
Regis_DeVallis · 2023-12-13 03:40

I got it figured out!

I did some digging into the network interfaces the container was
using, and found that my Traefik-public network was using eth0, and
the internet was accessible from eth1. I used this command: `ip route
get 8.8.8.8 | awk '{print $5}'`

I modified my post up and post down to match:

```yaml
      WG_POST_UP: iptables -A FORWARD -i %i -j ACCEPT; iptables -A
FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth1 -j
MASQUERADE
      WG_POST_DOWN: iptables -D FORWARD -i %i -j ACCEPT; iptables -D
FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth1 -j
MASQUERADE
```

----------------------------------------------------------------------
Spuxilet · 2023-12-13 10:13

I am also using wg-easy for vpn. I did not configure any WG\_POST\_UP
or WG\_POST\_DOWN it just works. No need for iptables rules from
clients.

----------------------------------------------------------------------
Regis_DeVallis · 2023-12-13 15:01

Because my network interface is different due to traefik. I don't use
eth0 to access the internet, I use eth1.