Wireguard chain connection issue #491
Comments
|
what is a wireguard chain (2 servers)? can you make a diagram of your topology? below is a tutorial of udp2raw+openvpn, which should be helpful for wireguard as well: https://github.com/wangyu-/udp2raw/wiki/udp2raw-openvpn-config-guide in the end there is a section about transparently redirect traffic |
Client -> wireguard (client) -> udp2raw (client) -> udp2raw (server) -> wireguard server 1 -> Wireguard server 2 All works fine until Wireguard server 1 connects to Wireguard server 2 with wg-quick@wgclient2. After that, all udp2raw traffic goes through the wgclient2 interface. I have read the guide you sent, but I can't figure it out. |
does this setting work well before you put udp2raw into the chain? if so, could you please explain a bit how udp2raw is making it harder to work?
how is it going here? I guess the server 1 is running two wireguards, 1 as client and 1 as server. So you have two wg interface on server 1. Is this correct?
you posted some info, but you didn't mention on which machine you are running them. There is too much guess work for me. Can you add the missing info? Also it will be helpful if you post all your udp2raw commands and wireguard confs. |
Server using Ubuntu 22.04.3 LTS (GNU/Linux 5.15.0-83-generic x86_64) udp2raw server config (Located on Server 1): Wg server config (Located on Server 1): Wg client config (Located on Server 1): |
|
I've tried to route udp2raw.service via custom namespace, which connected to eth0 (default gateway), but it's too complicated for me now =) |
|
Can I fwmark udp2raw traffic via iptables and add route to the main table?
|
|
(I am not really very familiar with wireguard config) In your
I guess this means: once the wg client on server1 establish connection with the server2, the default route on server1 will be changed, and all traffic will go through server2 by default. Then this route change will hijack udp2raw_server's traffic, so it's causing problem. I guess the best practice is not to change the default route on server1. You instead add some specific rule to redict traffic from wg0 to wgchainclient. In this way, you won't have udp2raw or ssh's traffic being hijacked and causing weird problems.
This might not work. Since udp2raw is sending/receving packet at a low level, it's known to not work well together with iptables's fwmark. Methods based on marking udp2raw's traffic usually doesn't work.
If you insist on change the default route on server1. check the --lower-level option. If set correctly, it will bypass any iptables and ip route rules, sending packet directly to the network interface. |
Your goal is to let client's traffic go through wireguard sever2. Changing the default route of server1 is not necessary. I personally think changing the default route of a remote server is a bad practice and a source of trouble. Avoid whenever possible. |
Yeah, you're right. I've tried to change Allowed IPs to
but has the server 1 IP after check. Can you guide me on what I'm doing wrong? |
|
Also, the --lower-level option works just fine. Thank you very much. |
Hello,
I have faced a connection issue when using the Wireguard chain (2 servers) with udp2raw. Udp2raw receives packets until the Wireguard server (same server as udp2raw) is connected to Wireguard server 2. After that, I saw that the server received a syn from the client but did not send it back to the client.
This rule helps, but the client has a dynamic IP, which is not a solution.
ip rule add to client_ip/24 table mainCan anybody guide me on how to route all udp2raw traffic to the default network gateway (eth0 in my case)?
The text was updated successfully, but these errors were encountered: