2

I have a raspberry pi running an OpenVPN client connecting to a VPN provider and also a Wireguard server so I can connect to my home LAN from outside. I want to connect to my home through wireguard and send all the traffic through Openvpn connection.

This is my ifconfig output

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.5  netmask 255.255.255.0  broadcast 192.168.1.255

wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
        inet 172.1.1.1  netmask 255.255.255.0  destination 172.1.1.1

tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1500
        inet 10.8.8.17  netmask 255.255.255.0  destination 10.8.8.17

eth0 - is the gateway to the internet (connected to my home router)

When I connect to wireguard server without OpenVPN client running I can reach my internal LAN (192.168.1.X) and also get my requests forwarded to internet through raspberry pi (eth0). When I enable OpenVPN client (tun0 up) I cannot reach internal LAN and also I cannot reach Internet.

What I want to do is to connect to my home through wireguard and get all the traffic tunnelled through the openvpn connection (tun0).

This is my output from "route -n":

Before OpenVPN starts (wireguard works OK):

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    202    0        0 eth0
172.1.1.0       0.0.0.0         255.255.255.0   U     0      0        0 wg0
192.168.1.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0

After openVPN tun0 starts (wireguard connection does not reach internet and LAN clients):

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.8.8.1        128.0.0.0       UG    0      0        0 tun0 
0.0.0.0         192.168.1.1     0.0.0.0         UG    202    0        0 eth0 
10.8.8.0        0.0.0.0         255.255.255.0   U     0      0        0 tun0 
95.142.172.143  192.168.1.1     255.255.255.255 UGH   0      0        0 eth0 
128.0.0.0       10.8.8.1        128.0.0.0       UG    0      0        0 tun0 
172.1.1.0       0.0.0.0         255.255.255.0   U     0      0        0 wg0  
192.168.1.0     0.0.0.0         255.255.255.0   U     202    0        0 eth0 

My firewall rules:

-A FORWARD -i wg0 -j ACCEPT
-A POSTROUTING -o eth0 -j MASQUERADE

Are there any firewall rules missing or any routes I have to add for this to work? What should I had?

Thanks!!

1

In short: The solution

Create a new routing table:

ip route add default via 192.168.1.5 dev eth0 table 7
ip rule add fwmark 0x55 priority 1000 table 7
ip route flush cache

Where 192.168.1.5 is the IP of your external interface (eth0). Now add this to your wg0.conf:

FwMark = 0x55

Now you will be able to connect to your home-server via WireGuard even when it's OpenVPN tunnel is open.

A longer explanation

When you start your OpenVPN tunnel, a new route is set into the main routing table. This route might look like this: 0.0.0.0/1 via 10.8.8.1 dev tun0 and mean, that all your internet-traffic should be sent out through the tunnel.

This is great, but whenever you want to communicate with your routing machine over the unprotected interface, the answers of your machine would also be sent into the tunnel. That is why you can no longer reach your server over https, even if you had forwarded port 443 to it. It's answers would simply be sent into the tunnel and be lost.

Whith setting up a second routing table which can be viewed via ip route show table 7 and the 0x55-rule we've basically told your machine to route every marked packet over the normal, unprotected eth0 interface. The rest will still be sent into the tunnel.

What else could be done?

OpenVPN-server

I actually found the solution back then when I hadn't even heared of WireGuard. I wanted to connect to my home network via OpenVPN at the time and was unable to do that, when the server had it's tunnel up. However, my own OpenVPN-server was listening on Port 993 so I marked every packet with "0x55" that passed through that port:

sudo iptables -t mangle -A OUTPUT -p tcp -m multiport --sport 993 -j MARK --set-mark 0x55

That made a VPN-connection to my VPN-connected server possible.

E-Mail Ports not protected

My VPN-provider does not allow sending mails through it's VPN because there had been SPAM problems. This rule would route the connection to my mail-accounts without passing them through the tunnel:

iptables -t mangle -A PREROUTING -p tcp --dport 25 -j MARK --set-mark 0x55

MAC-addresses without VPN

You might want a complete device being "unprotected". If you where using a swedish server and don't want to see swedish youtube ads on your tablet, you might want to do this:

iptables -t mangle -A PREROUTING -m mac --mac-source 4c:h7:9f:0l:17:k1 -j MARK --set-mark 0x55

you'd have to use your tablet's MAC address of course.

  • 2
    "I solved your question when trying to connect into my home-server via OpenVPN", does it mean a part of your post fit's as answer? If so edit your post to make it an answer and and ask an own question, referring to this for your problem. If not, please delete it from the answer section. – bummi Apr 8 at 18:39
  • sorry, I'd do it - but I've just stumbled over the last step. Hope it is ok now. – b0wtie Apr 8 at 18:58
0

You said "I want to connect to my home through wireguard and send all the traffic through Openvpn connection", which doesn't make sense. I am interpreting it as "I want to connect to my home through wireguard and send ALL OTHER traffic through Openvpn connection."

When you start the OpenVPN server, your default route changes from 192.168.1.1 to 10.8.8.1, which is routed through tun0. It looks like tun0's peer address is 95.142.172.143 which has its own /32 route defined, so traffic for that is always sent directly to the Internet via eth0. That static route exempts the tunnel endpoint from the default routing, and without it, the tunnel would not work.

This suggests that your OpenVPN client is configured to route all traffic to the remote side of the OpenVPN tunnel. This is a typical OpenVPN configuration, it would be used when you don't trust the local network and want all your traffic securely encrypted and routed via the OpenVPN server.

Once you start the OpenVPN server, all traffic for your Wireguard server is getting re-routed by that default route thru the OpenVPN tunnel and it goes to whatever is on the other side of that tunnel, where it presumably gets dropped.

I'm guessing what you need is to specify a static route to your Wireguard server similar to the way OpenVPN added a /32 route for its server (95.142.172.143). For example, if your Wireguard server was 100.100.100.10, you would add a static route for that IP to go via eth0. You'll be able to tell if you got it right because it will resemble the output you have in the routing table shown above for 95.142.172.143. To test on the command line, after you've started the OpenVPN server try:

# route add -host IP-OF-REMOTE-WIREGUARD-SERVER gw DEFAULT-GATEWAY-IP

Where "DEFAULT-GATEWAY-IP" is the IP address of your ISP router, which looks like 192.168.1.1 from your above examples. When you then do "netstat -rn", you should see the new route with the "UGH" flags just like the 95.142.172.143 route in your "netstat" output in the question.

To summarize, the tunnels should be traveling over the raw Internet connection. Your setup is broken because it's trying to stuff the Wireguard tunnel inside the OpenVPN tunnel.

  • Thanks for you reply. Indeed what I want is connect remotely to my home and send alll the traffic through the interface that is connected to as external VPN provider. Can you give an example of how of that static toute line should look like? Thanks! – Miguel Teixeira Feb 9 at 22:08
  • Updated answser with a sample command line. If that works, you'll have to figure out how to add it permanently, check the docs for your specific OS, it looks like in Raspbian it's in the dhcp client settings but the exact location varies depending on the release level. Do a search for "raspbian static route" (or whatever OS you have), and make sure the help page you find matches your OS version. – Velo Traveler Feb 10 at 23:42
  • Thank you for your reply. The wireguard server is not remote. I have the wireguard server within the lan. My goal is to connect remotely to my wireguard server and tunnel that trafiic out to the internet over my openvpn connection. This openvpn is a client that connects to a VPN subscription. That said I don't undetstand what should I put in IP-OF-REMOTE-WIREGUARD-SERVER you mentioned. Should it be the openvpn provider IP (95.142.172.143) or should it be the wireguard (wg0) internal IP? Thanks again!! – Miguel Teixeira Feb 11 at 23:45
0

I have exactly the same setup (openVPN-Server<->openVPN-Client/Wireguard-Server(MiddleMan)<->Wireguard-Client), but were only able to solve it half.

When I add folowing iptables rules to the MiddleMan in the MiddleMan WireGuard config:

PreUp = iptables -t nat -A POSTROUTING -s 10.200.200.0/24  -o tun0 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -s 10.200.200.0/24  -o tun0 -j MASQUERADE

where 10.200.200.0 is the wg0 network and tun0 the openvpn interface and add the following rules to the openVPN config on the MiddleMan:

route-nopull
route 192.168.178.0 255.255.255.0

where 192.168.178.0 is the internal network of the openVPN Server, I am able to ping and access the 192.168.178.0 network from the WireGuard Client (mobile phone).

But I still don't know how to forward the internet from the openVPN Server to the Wireguard Client. If I pull all the routes from the openVPN Server to the MiddleMan the default gateway on the MiddleMan gets replaced and there is no access from the WireGuard Client to the MiddleMan anymore. I just need to know the right routing, how to forward the internet traffic from the openVPN Server to the WireGuard Client without replacing the default gateway on the MiddleMan.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.