Offer Wireguard to DHCP Clients via dnsmasq

user_13840383 0
Viewed 1589

I'm trying to build a wireguard setup where I can distribute the wireguard VPN via dnsmasq to DHCP clients, so that they dhcp clients can only access the internet through the VPN.

However, there still seem to be problems with the correct routing, but I can't find it.

Structure: eth0: Internet wg0: wireguard eth1: here the dhcp clients are attached

eth1 init

/usr/bin/ip link set eth1 up
/usr/bin/ip addr add 10.10.1.1/24 dev eth1

wg0.conf

[Interface]
PrivateKey = $PRIVATE_KEY
Address = 10.20.40.11
Table = off
DNS = $DNS_SRV_ON_WG_SRV

[Peer]
PublicKey = $PUBLIC_KEY
AllowedIPs = 0.0.0.0/0
Endpoint = $WG_SERVER:51820

iptables

/usr/sbin/sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -i eth1 -o wg0 -j ACCEPT
iptables -A FORWARD -i wg0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables  -t nat -A POSTROUTING -o wg0 -j MASQUERADE

dnsmasq config

$(which dnsmasq)    --interface eth1 \
                    --bind-interfaces \
                    --dhcp-authoritative \
                    --dhcp-range=10.10.1.100,10.10.1.200,72h \
                    --resolv-file=$(dirname "$0")/dnsmasq_resolv.conf

The DHCP clients can ping the IP of eth1 and wg0, eth0 cannot be pinged (which should be correct)

But I don't see any traffic on wg0, so I think it's a problem with the routing:

Hope anyone can help

dhcp dnsmasq wireguard iptables
1 Answers

Found a solution

ip rule add from 10.10.1.0/24 lookup 200
ip route add default dev wg0 table 200
user_138403830
Related