<!DOCTYPE html>
<html>
<head>
<title></title>
<style type="text/css">p.MsoNormal,p.MsoNoSpacing{margin:0}</style>
</head>
<body><div>Hi Adrián,<br></div>
<div><br></div>
<div>Sounds like you're doing something similar to what I've been playing with. I chatted with Jason about it a bit, and he sorted me out with a better solution - perhaps it'll work for you too:<br></div>
<div><br></div>
<div>Instead of spinning up a Masquerade rule in iptables, have you tried just making sure that ProxyARP is enabled on the B side Ubuntu server? Try removing the masquerade from iptables, and run this instead:<br></div>
<div><br></div>
<pre>echo 1 > /proc/sys/net/ipv4/c<span class="font" style="font-family: menlo, consolas, monospace, sans-serif;"></span>onf/all/proxy_arp<br></pre><div><br></div>
<div>You may also need to enable IP forwarding:<br></div>
<div><br></div>
<pre>echo 1 > /proc/sys/net/ipv4/ip_forward<br></pre><div><br></div>
<div>If you want to make it permanent, add this to your /etc/sysctl.conf (again on the B side Ubuntu):<br></div>
<div><br></div>
<div><span class="font" style="font-family: menlo, consolas, monospace, sans-serif;">net.ipv4.conf.all.proxy_arp = 1</span><br></div>
<div><span class="font" style="font-family: menlo, consolas, monospace, sans-serif;">net.ipv4.conf.all.forwarding = 1</span><br></div>
<div><span class="font" style="font-family: menlo, consolas, monospace, sans-serif;"></span><br></div>
<div>You might be able to use net.ipv4.conf.<b>wg0 </b>instead, I've just used .all as an example <br></div>
<div><br></div>
<div>Let me know if that helps :)<br></div>
<div><br></div>
<div>E<br></div>
<div><br></div>
<div id="sig66226376"><div class="signature">--------------------------------------------<br></div>
<div class="signature">Q: Why is this email five sentences or less?<br></div>
<div class="signature">A: http://five.sentenc.es<br></div>
<div class="signature"><br></div>
</div>
<div><br></div>
<div><br></div>
<div>On Mon, 26 Mar 2018, at 10:33, Adrián Mihálko wrote:<br></div>
<blockquote type="cite"><div>Ah. The solution was trivial.<br></div>
<div><br></div>
<div>On B side, Ubuntu server:<br></div>
<div><br></div>
<div>post-up iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE<br></div>
<div><br></div>
<div>On my server eth0 doesn't exist it has another name: ens160.<br></div>
<div><br></div>
<div>Now it's working.<br></div>
<div><br></div>
<div><br></div>
<div><div><blockquote type="cite"><div>On 25 Mar 2018, at 11:19, Adrián Mihálko <<a href="mailto:adriankoooo@gmail.com">adriankoooo@gmail.com</a>> wrote:<br></div>
<div><br></div>
<div><div dir="ltr"><div>A side (<a href="http://192.168.2.0/24">192.168.2.0/24</a>):<br></div>
<div><br></div>
<div>LEDE router 192.168.2.1 (static route to access remote side <a href="http://192.168.1.0/24">192.168.1.0/24</a> pointing to 192.168.2.100)<br></div>
<div><br></div>
<div>Pi Zero with Wireguard (192.168.2.100, WG: 192.168.5.2)<br></div>
<div><br></div>
<div>Config:<br></div>
<div><br></div>
<div>auto wg0<br></div>
<div>iface wg0 inet static<br></div>
<div> pre-up ip link add dev wg0 type wireguard<br></div>
<div> post-up wg setconf wg0 /etc/wireguard/wireguard.conf<br></div>
<div> post-up ip link set dev wg0 up<br></div>
<div> post-up ip route add <a href="http://192.168.1.0/24">192.168.1.0/24</a> via 192.168.5.1 dev wg0<br></div>
<div> post-up iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE<br></div>
<div> address 192.168.5.2<br></div>
<div> netmask 255.255.255.0<br></div>
<div><br></div>
<div><br></div>
<div>B side (<a href="http://192.168.1.0/24">192.168.1.0/24</a>):<br></div>
<div><br></div>
<div>Unifi router 192.168.1.1 (static route to access remote side <a href="http://192.168.2.0/24">192.168.2.0/24</a> pointing to 192.168.1.54)<br></div>
<div><br></div>
<div>Ubuntu server with Wireguard (192.168.1.54, WG: 192.168.5.1)<br></div>
<div><br></div>
<div>Config:<br></div>
<div><br></div>
<div>iface wg0 inet static<br></div>
<div> pre-up /sbin/ip link add dev wg0 type wireguard<br></div>
<div> post-up /usr/bin/wg setconf wg0 /etc/wireguard/wg0.conf<br></div>
<div> post-up /sbin/ip route add <a href="http://192.168.2.0/24">192.168.2.0/24</a> via 192.168.5.2 dev wg0<br></div>
<div> post-up iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE<br></div>
<div> post-down /sbin/ip link del wg0<br></div>
<div> address 192.168.5.1<br></div>
<div> netmask 255.255.255.0<br></div>
<div><br></div>
<div>---<br></div>
<div><br></div>
<div>Everything is working great, except that on the "Pi Zero with Wireguard" I can't access/ping remote devices in the <a href="http://192.168.1.0/24">192.168.1.0/24</a> range, only the remote server 192.168.1.54. From any other machine in the same "A side" I am able to access devices in the <a href="http://192.168.1.0/24">192.168.1.0/24</a> range, just from the Pi Zero itself not.<br></div>
<div><br></div>
<div>What I am missing here?<br></div>
<div><br></div>
<div><br></div>
<div>pi@raspberrypizero:~ $ ping 192.168.1.54<br></div>
<div>PING 192.168.1.54 (192.168.1.54) 56(84) bytes of data.<br></div>
<div>64 bytes from <a href="http://192.168.1.54/">192.168.1.54</a>: icmp_seq=1 ttl=64 time=48.6 ms<br></div>
<div>64 bytes from <a href="http://192.168.1.54/">192.168.1.54</a>: icmp_seq=2 ttl=64 time=134 ms^C<br></div>
<div>--- 192.168.1.54 ping statistics ---<br></div>
<div>2 packets transmitted, 2 received, 0% packet loss, time 1002ms<br></div>
<div>rtt min/avg/max/mdev = 48.671/91.554/134.437/42.883 ms<br></div>
<div>pi@raspberrypizero:~ $ ping 192.168.1.100<br></div>
<div>PING 192.168.1.100 (192.168.1.100) 56(84) bytes of data.<br></div>
<div>^C<br></div>
<div>--- 192.168.1.100 ping statistics ---<br></div>
<div>6 packets transmitted, 0 received, 100% packet loss, time 5188ms<br></div>
<div><br></div>
<div>pi@raspberrypizero:~ $ traceroute 192.168.1.100<br></div>
<div>traceroute to 192.168.1.100 (192.168.1.100), 30 hops max, 60 byte packets<br></div>
<div> 1 192.168.5.1 (192.168.5.1) 42.279 ms 43.834 ms 44.678 ms<br></div>
<div> 2 * * *<br></div>
<div> 3 * * *<br></div>
<div> 4 * * *<br></div>
<div><br></div>
<div><br></div>
<div>---<br></div>
<div><br></div>
<div>B side is working great, I am able to ping everything, even from the Ubuntu server.<br></div>
<div><br></div>
<div><br></div>
<div>Regards,<br></div>
<div>Adrian<br></div>
</div>
</div>
</blockquote></div>
</div>
<div><u>_______________________________________________</u><br></div>
<div>WireGuard mailing list<br></div>
<div><a href="mailto:WireGuard@lists.zx2c4.com">WireGuard@lists.zx2c4.com</a><br></div>
<div><a href="https://lists.zx2c4.com/mailman/listinfo/wireguard">https://lists.zx2c4.com/mailman/listinfo/wireguard</a><br></div>
</blockquote><div><br></div>
</body>
</html>