Access to server's local network

[Jim Brandt]

Hi,

I set up WireGuard on two Ras Pi's, one acting as a vpn server and the
other as a portable access point. The server uses only its eth0 interface.
The access point uses one wifi interface for the public side, and another
wifi plus eth0 for clients. The iptables are similar to www.ckn.io.
Packets leaving the wg0 interface on the access point are NATed.

 I'd like to allow clients to access the server's local subnet as well as
routing to the public net but do not see how to do it.  Packets sent to a
local ip seem to get dropped at the server end of the tunnel because that
is as far as a traceroute can go, and tcpdump does not show the packets
arriving at the wg0 interface. Packets to public ip's work as expected.
ProxyARP is enabled on the server but that does not seem to be the current
issue. Could anyone suggest a way to do this?

Client wg-quick config:

[Interface]
Address = 10.200.200.3/32
DNS = 10.200.200.1
PrivateKey = ...
MTU = 1500

[Peer]
PublicKey = ...
AllowedIPs = 0.0.0.0/0
Endpoint = 10.0.0.23:51820
PersistentKeepalive = 21

server wg-quick config:

[Interface]
Address = 10.200.200.1/32
ListenPort = 51820
PrivateKey = ...
MTU = 1500

[Peer]
PublicKey = ...
AllowedIPs = 10.200.200.3/32

sudo ip route show:

default via 10.0.0.1 dev eth0 src 10.0.0.23 metric 202
10.0.0.0/24 dev eth0 proto kernel scope link src 10.0.0.23 metric 202
10.200.200.3 dev wg0 scope link

Click here to Reply or Forward
64.86 GB (30%) of 215 GB used
Manage <https://www.google.com/settings/u/0/storage?hl=en>
Terms <https://www.google.com/intl/en/policies/terms/> - Privacy
<https://www.google.com/intl/en/policies/privacy/>
Last account activity: 1 minute ago
Details
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.zx2c4.com/pipermail/wireguard/attachments/20180502/00907e1b/attachment.html>