wireguard -- port forwarding while retaining original IP?

Question

I'm attempting to DDOS protect one of my servers (called "the client" from here on out to eliminate confusion). To do that, I'm renting a cheap server from OVH (called "the server") and am attempting to route all traffic from the server to the client, so that it passes through the DDOS protection.

I decided on Wireguard as the best solution, and successfully linked the two servers. I am now trying to forward ports from the client to the server, and have tried this setup (where 10.20.40.2 is the client, and 10.20.40.1 is the server):

sudo iptables -t nat -A PREROUTING -p tcp --dport $port -j DNAT --to-destination 10.20.40.2                                                            
sudo iptables -A FORWARD -o wg0 -p tcp --syn --dport $port -m conntrack --ctstate NEW -j ACCEPT                                                        
sudo iptables -A FORWARD -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT                                                                      
sudo iptables -A FORWARD -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT                                                                     
sudo iptables -t nat -A PREROUTING -p tcp --dport $port -j DNAT --to-destination 10.20.40.2                                                            
sudo iptables -t nat -A POSTROUTING -o wg0 -p tcp --dport $port -d 10.20.40.2 -j SNAT --to-source 10.20.40.1

This works fine, except that from the client's point of view, every IP is 10.20.40.1 aka the server's. Is there a way I can forward the public IP addresses to the client? I have seen this question on StackExchange before, but with the limitation that "the client" in their situation was inaccessible. I have full access to both servers, so installing software on either is not a problem.

The client's Wireguard configuration:

[Interface]                                                                                                                                                              
PrivateKey = (redacted)                                                                                                             
ListenPort = 51820                                                                                                                                                       
Address = 10.20.40.2/16                                                                                                                                                  
                                                                                                                                                                         
[Peer]                                                                                                                                                                   
PublicKey = (redacted)                                                                                                               
Endpoint = (redacted):51820                                                                                                                                          
AllowedIPs = 10.20.40.0/16

The server's Wireguard configuration:

[Interface]                                                                                                                                                              
PrivateKey = (redacted)                                                                                                                                                  
ListenPort = 51820                                                                                                                                                       
Address = 10.20.40.1/24                                                                                                                                                  
                                                                                                                                                                         
[Peer]                                                                                                                                                                   
PublicKey = (redacted)                                                                                                                                                   
AllowedIPs = 10.20.40.0/24

Answer 1

Swap IP addresses in POSTROUTING:

sudo iptables -t nat -A POSTROUTING -o wg0 -p tcp --dport $port -d 10.20.40.1 -j SNAT --to-source 10.20.40.2

Allow IPs in client wireguard configuration:

AllowedIPs = 0.0.0.0/0

As packets will now have original source address.

Answer 2

Yes, by not using that SNAT rule whose job is literally to replace the original IP address.

You probably added that SNAT rule to trick the target server into sending responses over the WG tunnel interface. This can better be done in other ways, such as policy routing:

1. On your server, create a new routing table, with a default route that points over 'wg0' and nothing else:

   ip -4 route add default dev wg0 table 1234
   

2. On the same server, add policy routing rules which associate the source IP address 10.20.40.2 with the new routing table whenever a response is about to be sent:

   ip -4 rule add pref 1000 from 10.20.40.2 lookup 1234
   

Answer 3

I used this WireGuard configuration in the end to solve my issue:

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

As well as this command to port-forward:

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport [PORT] -j DNAT --to-destination 10.20.40.2