I want to move away from Cloudflare tunnels, so I rented a cheap VPS from Hetzner and tried to follow this guide. Unfortunately, the WireGuard setup didn’t work. I’m trying to forward all traffic from the VPS to my homeserver and vice versa. Are there any other ways to solve this issue?

VPS Info:

OS: Debian 12

Architecture: ARM64 / aarch64

RAM: 4 GB

Traffic: 20 TB

  • AlexPewMaster@lemmy.zipOP
    link
    fedilink
    English
    arrow-up
    1
    ·
    7 months ago

    The biggest obstacle for me is the connection between the VPS and my homeserver. I have tried this today and I tried pinging 10.0.0.2 (the homeserver IP via WireGuard) and get this as a result:

    PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
    From 10.0.0.1 icmp_seq=1 Destination Host Unreachable
    ping: sendmsg: Destination address required
    From 10.0.0.1 icmp_seq=2 Destination Host Unreachable
    ping: sendmsg: Destination address required
    ^C
    --- 10.0.0.2 ping statistics ---
    2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1019ms
    

    Not sure why though.

    • Admiral Patrick@dubvee.org
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      7 months ago

      Can you post your WG config (masking the public IPs and private key if necessary)?

      With wireguard, the allowed-ips setting is basically the routing table for it.

      Also, you don’t want to set the endpoint address (on the VPS) for your homeserver peer since it’s behind NAT. You’ll only want to set that on the ‘client’ side. Since you’re behind NAT, you’ll also want to set the persistent keepalive in the client peer so the tunnel remains open.

      • AlexPewMaster@lemmy.zipOP
        link
        fedilink
        English
        arrow-up
        2
        ·
        7 months ago

        Hi, thank you so much for trying to help me, I really appreciate it!

        VPS wg0.conf:

        [Interface]
        Address = 10.0.0.1/24
        ListenPort = 51820
        PrivateKey = REDACTED
        
        PostUp = iptables -t nat -A PREROUTING -p tcp -i eth0 '!' --dport 22 -j DNAT --to-destination 10.0.0.2; iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source SERVER_IP
        PostUp = iptables -t nat -A PREROUTING -p udp -i eth0 '!' --dport 55107 -j DNAT --to-destination 10.0.0.2;
        
        PostDown = iptables -t nat -D PREROUTING -p tcp -i eth0 '!' --dport 22 -j DNAT --to-destination 10.0.0.2; iptables -t nat -D POSTROUTING -o eth0 -j SNAT --to-source SERVER_IP
        PostDown = iptables -t nat -D PREROUTING -p udp -i eth0 '!' --dport 55107 -j DNAT --to-destination 10.0.0.2;
        
        [Peer]
        PublicKey = REDACTED
        AllowedIPs = 10.0.0.2/32
        

        Homeserver wg0.conf:

        [Interface]
        Address = 10.0.0.2/24
        PrivateKey = REDACTED
         
        [Peer]
        PublicKey = REDACTED
        AllowedIPs = 0.0.0.0/0
        PersistentKeepalive = 25
        Endpoint = SERVER_IP:51820
        

        (REDACTED would’ve been the public / private keys, SERVER_IP would’ve been the VPS IP.)

        • Admiral Patrick@dubvee.org
          link
          fedilink
          English
          arrow-up
          3
          ·
          7 months ago

          On the surface, that looks like it should work (assuming all the keys are correct and 51820/udp is open to the world on your VPS).

          Can you ping the VPS’s WG IP from your homeserver and get a response? If so, try pinging back from the VPS after that.

          Until you get the bidirectional traffic going, you might try pulling out the iptables rules from your wireguard script and bringing everything back up clean.

          • AlexPewMaster@lemmy.zipOP
            link
            fedilink
            English
            arrow-up
            1
            ·
            7 months ago

            I do not get a response when pinging the VPS’s WG IP from my homeserver. It might have something to do with the firewall that my VPS provider (Hetzner) is using. I’ve now allowed the port 51820 on UDP and TCP and it’s still the same as before… This is weird.

            • Admiral Patrick@dubvee.org
              link
              fedilink
              English
              arrow-up
              2
              ·
              7 months ago

              I’m not familiar with Hetzner, but I know people use them; haven’t heard any kinds of blocks for WG traffic (though I’ve read they do block outbound SMTP).

              Maybe double-check your public and private WG keys on both ends. If the keys aren’t right, it doesn’t give you any kind of error; the traffic is just silently dropped if it doesn’t decrypt.

              • AlexPewMaster@lemmy.zipOP
                link
                fedilink
                English
                arrow-up
                2
                ·
                7 months ago

                Hmm, the keys do match on the two different machines. I have no idea why this doesn’t work…

                • Admiral Patrick@dubvee.org
                  link
                  fedilink
                  English
                  arrow-up
                  2
                  ·
                  edit-2
                  7 months ago

                  Dumb question: you’re starting wireguard right? lol

                  In most distros, it’s systemctl start wg-quick@wg0 where wg0 is the name of the config file in /etc/wireguard

                  If so, then maybe double/triple check any firewalls / iptables rules. My VPS providers don’t have any kind of firewall in front of the VM, but I’m not sure about Hetzner.

                  Maybe try stopping wireguard, starting a netcat listener on 51820 UDP and seeing if you can send to it from your homelab. This will validate that the UDP port is open and your lab can make the connection.

                  ### VPS
                  user@vps:  nc -l -u VPS_PUBLIC_IP 51820
                  
                  ### Homelab
                  user@home:  echo "Testing" | nc -u VPS_PUBLIC_IP 51820
                  
                  ### If successful, VPS should show:
                  user@vps:  nc -l -u VPS_PUBLIC_IP 51820
                  Testing
                  
                  

                  I do know this is possible as I’ve made it work with CG-NAT on both ends (each end was a client and routed through the VPS).

                  • AlexPewMaster@lemmy.zipOP
                    link
                    fedilink
                    English
                    arrow-up
                    2
                    ·
                    7 months ago

                    The command you provided for the VPS returns UDP listen needs -p arg, so I just added -p right before the port number and then it worked. Running the homelab command returns no port[s] to connect to… Not good.