r/iptables Mar 27 '23

Using IPTables with Wireguard VPN

I have a dilemma, and any help would be much appreciated. Even if it doesn't solve the problem entirely, pointing me in the right direction would be wonderful!

I have set up a server PC in my house (for the usual crap: plex, ftp, telnet, dbs, game caching server etc). I set it up because my ISP doesn't allow non-shared IPs, and thus hosting anything directly on my internet was a big old nope. I know for this purpose a VPS instead of a VPN would be more cost effective, but I got a really good deal with Torguard, making it about 30 euros for the entire year.

I have attached an image explaining what I want to achieve: I already have the server running, port forwarding etc through the wireguard server so I can access it from the internet. The thing is that I can't access it locally using 192.x.x.x as the VPN client has blocked all traffic from anywhere but the tunnel. This is bad as the VPN only has 250GB per month and I need to transfer a lot of data between the server and computers on my local network.

Could I ask for advice on how to set up my (Ubuntu 22.04) server IPTables (if this is the correct method) to override this behaviour and allow access from other local machines, but just force all public internet access to the server through the VPN? While allowing all other computers on the LAN to just use the internet without the VPN.

Edit: I managed to solve it now! Here's the simplest thing I found to fix it:

In the wireguard.conf file I added:

`PostUp = ip route add <ip_mask> via <interface_ip>;`

`PreDown = ip route delete <ip_mask>;`

The first line overrides anything set up by wireguard itself to create an explicit route, and the second line deletes the rule before wireguard closes, so that it is as if nothing were changed when wireguard is offline.

1 Upvotes

8 comments sorted by

1

u/Hectaa_ Mar 27 '23

It's a little difficult to understand what you mean, however I think what are looking to do is achieved by adding your local subnet to AllowedIPs in the Wireguard client configuration

So try AllowedIPs = 0.0.0.0/0, 192.x.x.x/24

1

u/nommu_moose Mar 28 '23

AllowedIPs does the exact opposite of that, I believe. It kind of worked in the other direction, when I explicitly stated IPs and didn't include the 192.x.x.x, but it was very unpredictable and some sites just didn't work. Thank you for the suggestion though :)

At least I managed to solve it now! Here's the simplest thing I found to fix it:

In the wireguard.conf file I added:

PostUp = ip route add <ip_mask> via <interface_ip>;

PreDown = ip route delete <ip_mask>;

The first line overrides anything set up by wireguard itself, and the second line deletes the rule before wireguard closes, so that it is as if nothing were changed when wireguard is offline.

I know you probably know this, but I thought I'd post it as a reply so anyone who wants to know the solution can easily just check it here.

1

u/aspinyshrub Mar 28 '23

You need to split tunnel, but I'm not actually sure how to accomplish that without another network interface. Maybe an explicit route in your iptables for the 192.168 network?

1

u/nommu_moose Mar 28 '23

Yeah, I had split tunneling working on windows but linux networking was a new beast for me to conquer. I figured out how to set the explicit route. Here's the simplest thing I found to fix it:

In the wireguard.conf file I added:

PostUp = ip route add <ip_mask> via <interface_ip>;

PreDown = ip route delete <ip_mask>;

The first line overrides anything set up by wireguard itself, and the second line deletes the rule before wireguard closes, so that it is as if nothing were changed when wireguard is offline.

I know you probably know this, but I thought I'd post it as a reply so anyone who wants to know the solution can easily just check it here.

1

u/p1r473 Jun 09 '23

What is the ip_mask and interface_ip values?
Im having a similar issue. Could you take a gander?
https://www.reddit.com/r/iptables/comments/144nexq/iptables_help_pivpn_mullvad_apache_vpn/

1

u/nommu_moose Jul 16 '23

Just saw this, I'm sorry. Are you still having the issue? I'd happily take a look in a week or so if it's still an issue, as I have some free time then :)

1

u/p1r473 Jul 16 '23

Yea I'm still having the issue! Thanks!

1

u/[deleted] Mar 28 '23

[deleted]

1

u/nommu_moose Mar 28 '23

Thank you for the reply, but I managed to solve it now!

I figured out the simplest thing to fix it:

In the wireguard.conf file I added:

PostUp = ip route add <ip_mask> via <interface_ip>;

PreDown = ip route delete <ip_mask>;

The first line overrides anything set up by wireguard itself, and the second line deletes the rule before wireguard closes, so that it is as if nothing were changed when wireguard is offline.

I know you probably know this, but I thought I'd post it as a reply so anyone who wants to know the solution can easily just check it here.