Force a specific IP for outgoing WG traffic with SNAT?

Roman Mamedov rm at
Thu Feb 16 19:07:47 UTC 2023


I'm trying to move all my WG communication with peers to a non-primary IP of my server.

It has IPs added like this:

    inet6 2001:db8::ca6c/128 scope global deprecated 
       valid_lft forever preferred_lft 0sec
    inet6 2001:db8::1/128 scope global nodad 
       valid_lft forever preferred_lft forever

What I tried:

  ip6tables -t nat -I POSTROUTING -d 2000::/3 -p udp --dport 51820 -j SNAT --to-source 2001:db8::ca6c

Also tried to filter by --sport, and also briefly without a port filter at all.

This has zero effect, as shown by tcpdump all the WG traffic still originates from 2001:db8::1

Does anyone have an idea why is that? Thanks

With respect,

More information about the WireGuard mailing list