0

I've a Windows Server 2019 Std. running wireguard in listening mode on the Internet. Another Windows client at home also runs wireguard.

I can ping from server to client, but not the other way round. If I turn off the firewall on the server, the client can ping the server as well.

In the "Windows Defender Firewall with Advanced Security" I don't see any conflicting blocking rule. I added an allow rule that allows everything from everywhere for ICMPv4 protocol. This makes the server pingable over it's public IP, yet ping via wireguard still won't work.

Any idea how I can bring the firewall to accept incoming ICMP packets on the adapter created by wireguard?

Edit: configs

wireguard server:

[Interface]
PrivateKey = <priv key srv>
ListenPort = 50001
Address = 172.16.60.1/32

[Peer]
PublicKey = <pub key clt>
AllowedIPs = 172.16.60.2/32
PersistentKeepalive = 5

wireguard client:

[Interface]
PrivateKey = <priv key clt>
Address = 172.16.60.2/32

[Peer]
PublicKey = <pub key srv>
AllowedIPs = 172.16.60.1/32
Endpoint = <pub ip srv>:50001

the firewall rule that allowed ping via Internet, yet not via wireguard:

netsh advfirewall firewall add rule name="ping" protocol=ICMPV4 dir=in action=allow
Improve this question
2
  • Could you add to your post the wireguard configuration files from client and server?
    – harrymc
    Jun 9, 2023 at 10:18
  • @harrymc done! thx!
    – grasbueschel
    Jun 9, 2023 at 10:39

1 Answer 1

Reset to default
0

Found it! It was indeed a blocking rule that I missed on the first look: RDP Defender - Block 172.16.60.2

So at some point Windows Defender obviously added that rule (I looked through the blocking rules before enabling the tunnel).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .