I need some help with Wireguard reddit / selfhosted ---------------------------------------------------------------------- zebutron · 2023-12-31 16:08 Background I will start by saying that I'm not a complete beginner and I actually work in tech support but most of that isn't networking. I've decided to try out creating a home lab and the first thing I wanted to do was start with a VPN so any local services would be accessible. I know Talescale is often spoken about but it uses Wireguard and I want to minimize third parties. I've done some reading up on the Wireguard config files and basic setup. To test it out and get a feel, I decided to run Wireguard in Docker on an older MB Pro running Monterey. I found a Docker compose file which seemed straightforward and uses wg-easy for a nice web UI. [https://github.com/wg-easy/wg-easy](https://github.com/wg-easy/wg- easy) Portforwarding for 51820 is set for the MBP. Problem Container runs, web UI is accessible, client can be added. Client (Android) connects. So far so good. Client can't reach anything at all. No local services, not the Internet. The web UI as well as via exec into the container does show minimal traffic. Server IP for the tunnel is at 10.8.0.1 and the tunnel network is 10.8.0.0/24. Client gets an IP of 10.8.0.2. Allowed IPs in the docker compose, I've tried everything I can think of. 0.0.0.0/0 nothing Local lan/24 and tunnel/24 nothing. Include the docker container in there? Nothing. Container iptables are, afaik, all good and everything is set to allow. I can reach the web UI on the local network from other devices. The MBP firewall is turned off. What can I do to troubleshoot here? - I should probably add another client that is a computer. - ping test? Trace Route? ---------------------------------------------------------------------- ElevenNotes · 2023-12-31 16:23 'net.ipv4.ip_forward=1' set? ---------------------------------------------------------------------- Accomplished-Lack721 · 2023-12-31 16:53 You might be able to simplify things for yourself substantially. Does your router have an option to function as a Wireguard server? Mine (an Asus ax11000) can run its own Wireguard or OpenVPN server with a fairly straightforward GUI. ---------------------------------------------------------------------- _3xc41ibur · 2023-12-31 16:55 Traceroute to 1.1.1.1. See if and where hops stop. If successful, make sure DNS is set properly. I've set my Android wg client to Pihole on my home network, but you could use 1.1.1.1 or whichever server you desire ---------------------------------------------------------------------- zebutron · 2023-12-31 17:01 I've got an older AVM Fritzbox that had VPN options but not Wireguard. Options include Fritzbox to Fritzbox, company VPN and "upload file" without any specifications. I could probably find out more but I also want to replicate what I'm doing without being hardware dependent. ---------------------------------------------------------------------- zebutron · 2023-12-31 17:30 Listed in the docker run host config and I just check and it is in sysctl. Anyone wondering how to check : sysctl -a ---------------------------------------------------------------------- zebutron · 2023-12-31 17:38 Good suggestion. Traceroute doesn't return anything outside of the docker container but the MBP gets it in 7 hops. Maybe only the port traffic is going out? Iptables need adjustment? ---------------------------------------------------------------------- _3xc41ibur · 2023-12-31 18:38 I meant traceroute from the problematic device, in this case, your android client. I use Fing for Android network tools as it includes device scanning, WOL, ping, and traceroute, but feel free to use what you like. ---------------------------------------------------------------------- rozman50 · 2023-12-31 19:51 Try setting WG_PORT to 51820. Even though it’s set as default value, it wasn’t working for me, until I manually set. ---------------------------------------------------------------------- Laptopgeek1310 · 2023-12-31 20:38 My advice is ignore the container option and run pivpn, it makes a wireguard vpn in like 2 mins and is easy for beginners. ---------------------------------------------------------------------- zebutron · 2023-12-31 22:10 Thanks for clarifying and for the mention of Fing. Traceroute work on the client and goes through the home network. I looked at the connection again and it isn't that it doesn't work but that it is crawling so slow that the connections to http drops. Now I'm more confused than I already was but at least I know more. Thank you. ---------------------------------------------------------------------- tzw9373 · 2023-12-31 23:36 I had the same issue and could never resolve, curious to hear what you find. ---------------------------------------------------------------------- lannistersstark · 2023-12-31 23:46 Can you share you wireguard config itself after removing passkey/domain?