Example config for VyOS that works fine:
r1 server, VyOS 1.4-rolling-202102010218
r2 client, VyOS 1.4-rolling-202102020218
server config:
set interfaces dummy dum0 address '100.64.0.1/24'
set interfaces dummy dum0 description 'LAN'
set interfaces wireguard wg01 address '10.11.0.17/24'
set interfaces wireguard wg01 description 'RoadWarrior'
set interfaces wireguard wg01 peer PEER001 allowed-ips '10.10.1.26/32'
set interfaces wireguard wg01 peer PEER001 pubkey 'xxxw='
set interfaces wireguard wg01 port '51820'
set protocols static interface-route 10.10.1.26/32 next-hop-interface wg01
Client config:
set interfaces wireguard wg01 address '10.10.1.26/32'
set interfaces wireguard wg01 description 'Server-SERVER-203.0.113.1'
set interfaces wireguard wg01 peer SERVER address '203.0.113.1'
set interfaces wireguard wg01 peer SERVER allowed-ips '10.11.0.0/24'
set interfaces wireguard wg01 peer SERVER allowed-ips '100.64.0.0/24'
set interfaces wireguard wg01 peer SERVER port '51820'
set interfaces wireguard wg01 peer SERVER pubkey 'yyy4='
set nat source rule 10 outbound-interface 'wg01'
set nat source rule 10 source address '100.64.22.0/24'
set nat source rule 10 translation address 'masquerade'
set protocols static interface-route 10.11.0.0/24 next-hop-interface wg01
set protocols static interface-route 100.64.0.0/24 next-hop-interface wg01
Ping from server
vyos@r1-roll:~$ show ip route 10.10.1.26
Routing entry for 10.10.1.26/32
Known via “static”, distance 1, metric 0, best
Last update 00:06:42 ago
-
directly connected, wg01, weight 1
vyos@r1-roll:~$ ping 10.10.1.26 count 1
PING 10.10.1.26 (10.10.1.26) 56(84) bytes of data.
64 bytes from 10.10.1.26: icmp_seq=1 ttl=64 time=0.438 ms
— 10.10.1.26 ping statistics —
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.438/0.438/0.438/0.000 ms
Ping from client site to address of server and LAN network on server:
vyos@r2-roll:~$ show ip route | match wg
C>* 10.10.1.26/32 is directly connected, wg01, 00:14:42
S>* 10.11.0.0/24 [1/0] is directly connected, wg01, 00:08:40
S>* 100.64.0.0/24 [1/0] is directly connected, wg01, 00:08:40
vyos@r2-roll:~$ ping 10.11.0.17 count 1
PING 10.11.0.17 (10.11.0.17) 56(84) bytes of data.
64 bytes from 10.11.0.17: icmp_seq=1 ttl=64 time=0.356 ms
--- 10.11.0.17 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.356/0.356/0.356/0.000 ms
vyos@r2-roll:~$
vyos@r2-roll:~$ ping 100.64.0.1 count 1
PING 100.64.0.1 (100.64.0.1) 56(84) bytes of data.
64 bytes from 100.64.0.1: icmp_seq=1 ttl=64 time=0.518 ms
--- 100.64.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.518/0.518/0.518/0.000 ms
vyos@r2-roll:~$
As you can see, all works correctly.
On the VyOS site, you don’t need any directly iptables commands like
iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
Try to check on the client site for example if enabled port-forwarding/routing?
sudo sysctl net.ipv4.ip_forward
sudo ip route get 10.11.0.17