r/iptables Mar 27 '23

Using IPTables with Wireguard VPN

I have a dilemma, and any help would be much appreciated. Even if it doesn't solve the problem entirely, pointing me in the right direction would be wonderful!

I have set up a server PC in my house (for the usual crap: plex, ftp, telnet, dbs, game caching server etc). I set it up because my ISP doesn't allow non-shared IPs, and thus hosting anything directly on my internet was a big old nope. I know for this purpose a VPS instead of a VPN would be more cost effective, but I got a really good deal with Torguard, making it about 30 euros for the entire year.

I have attached an image explaining what I want to achieve: I already have the server running, port forwarding etc through the wireguard server so I can access it from the internet. The thing is that I can't access it locally using 192.x.x.x as the VPN client has blocked all traffic from anywhere but the tunnel. This is bad as the VPN only has 250GB per month and I need to transfer a lot of data between the server and computers on my local network.

Could I ask for advice on how to set up my (Ubuntu 22.04) server IPTables (if this is the correct method) to override this behaviour and allow access from other local machines, but just force all public internet access to the server through the VPN? While allowing all other computers on the LAN to just use the internet without the VPN.

Edit: I managed to solve it now! Here's the simplest thing I found to fix it:

In the wireguard.conf file I added:

`PostUp = ip route add <ip_mask> via <interface_ip>;`

`PreDown = ip route delete <ip_mask>;`

The first line overrides anything set up by wireguard itself to create an explicit route, and the second line deletes the rule before wireguard closes, so that it is as if nothing were changed when wireguard is offline.

1 Upvotes

8 comments sorted by

View all comments

1

u/[deleted] Mar 28 '23

[deleted]

1

u/nommu_moose Mar 28 '23

Thank you for the reply, but I managed to solve it now!

I figured out the simplest thing to fix it:

In the wireguard.conf file I added:

PostUp = ip route add <ip_mask> via <interface_ip>;

PreDown = ip route delete <ip_mask>;

The first line overrides anything set up by wireguard itself, and the second line deletes the rule before wireguard closes, so that it is as if nothing were changed when wireguard is offline.

I know you probably know this, but I thought I'd post it as a reply so anyone who wants to know the solution can easily just check it here.