4 ms·

I did something similar with Wireguard but wasn't able to get it to do what I need. I'm trying to give my VPS access to other computers on my home network. The

I did something similar with Wireguard but wasn't able to get it to do what I need. I'm trying to give my VPS access to other computers on my home network. The Pi and my VPS can communicate with each other just fine. For some reason the pi won't forward any packets from the VPS, they just seem to drop. I've scoured all config that I could think of, iptables, network adaptors, Wireguard, but can't find the cause. Anyone encounter this or have a place to point me for help?

johtso 6y ago
I set something like this up the other day using ZeroTier rather than Wireguard. Followed the instructions here and it "just worked" https://zerotier.atlassian.net/wiki/spaces/SD/pages/224395274/Route+between+ZeroTier+and+Physical+Networks https://zerotier.atlassian.net/wiki/spaces/SD/pages/22439527... The key was enabling IP forwarding, and setting the right iptables rules.
granra 6y ago
Is ip_forward[1] enabled on the rpi? Also is your home network's cidr in allowed ips on the vps' wireguard interface? [1]: https://docs.mysirena.xyz/centos-7/prefilight-configuration/how-to-enable-ip-forwarding https://docs.mysirena.xyz/centos-7/prefilight-configuration/...
- driverdan 6y ago
  Yes, IP forwarding is enabled and my home network is set under AllowedIPs.
  - granra 6y ago
    You can trace log iptables and see first if the wireguard traffic is being blocked by some rule `iptables -t raw -I PREROUTING -p udp --dport 51820 -j TRACE` (assuming default 51820 port) and look at dmesg or `journalctl -f` If that is not being blocked then you can look at `iptables -t raw -I PREROUTING -s <vps' wireguard ip> -j TRACE` and try pinging or reaching a service on your home network and look at dmesg again. Just don't forget to remove these rules again as they will continue to log. Beyond that, I'm not sure.
jjice 6y ago
Have you tried this setting? This worked for me and I use my Pi as a media server and my VPN as a way to get all my machines to connect to it (a hub, I guess). https://linuxconfig.org/how-to-turn-on-off-ip-forwarding-in-linux https://linuxconfig.org/how-to-turn-on-off-ip-forwarding-in-... If you're running Docker, I believe it sets this by default, but try setting this on your VPS. I don't know enough about devops to know if there is an inherit danger to this, so take my advice with a grain of salt, but this worked for me.
- driverdan 6y ago
  Yes, IP forwarding is enabled.

johtso 6y ago

I set something like this up the other day using ZeroTier rather than Wireguard. Followed the instructions here and it "just worked" https://zerotier.atlassian.net/wiki/spaces/SD/pages/224395274/Route+between+ZeroTier+and+Physical+Networks https://zerotier.atlassian.net/wiki/spaces/SD/pages/22439527... The key was enabling IP forwarding, and setting the right iptables rules.

granra 6y ago

Is ip_forward[1] enabled on the rpi? Also is your home network's cidr in allowed ips on the vps' wireguard interface? [1]: https://docs.mysirena.xyz/centos-7/prefilight-configuration/how-to-enable-ip-forwarding https://docs.mysirena.xyz/centos-7/prefilight-configuration/...

driverdan 6y ago
Yes, IP forwarding is enabled and my home network is set under AllowedIPs.
- granra 6y ago
  You can trace log iptables and see first if the wireguard traffic is being blocked by some rule `iptables -t raw -I PREROUTING -p udp --dport 51820 -j TRACE` (assuming default 51820 port) and look at dmesg or `journalctl -f` If that is not being blocked then you can look at `iptables -t raw -I PREROUTING -s <vps' wireguard ip> -j TRACE` and try pinging or reaching a service on your home network and look at dmesg again. Just don't forget to remove these rules again as they will continue to log. Beyond that, I'm not sure.

jjice 6y ago

Have you tried this setting? This worked for me and I use my Pi as a media server and my VPN as a way to get all my machines to connect to it (a hub, I guess). https://linuxconfig.org/how-to-turn-on-off-ip-forwarding-in-linux https://linuxconfig.org/how-to-turn-on-off-ip-forwarding-in-... If you're running Docker, I believe it sets this by default, but try setting this on your VPS. I don't know enough about devops to know if there is an inherit danger to this, so take my advice with a grain of salt, but this worked for me.

driverdan 6y ago
Yes, IP forwarding is enabled.