How to SSH to Wireguard Server from Windows Client with VPN

networkingprivacySecurityvpnwireguard

I have Wireguard server on Rocky 8.7, when I connect to the server I route all client traffic through Wireguard

this is quotes from setup script, of course all variables is set (and all works good)

config for Wireguard server:

cat << EOF | sudo tee -a /etc/wireguard/${WG_INTERFACE}.conf
[Interface]
PostUp = wg set %i private-key /etc/wireguard/${WG_INTERFACE}.pk
Address = 10.0.0.1/32
ListenPort = ${WG_PORT}
[Peer]
PublicKey = ${WG_CLIENT_PUBLIC_KEY}
AllowedIPs = 10.0.0.2/32
EOF

config for Wireguard client:

cat << EOF >> ~/wg_client.conf
[Interface]
PrivateKey = ${WG_CLIENT_PRIVATE_KEY}
Address = 10.0.0.2/32
DNS = 8.8.8.8
[Peer]
PublicKey = ${WG_SERVER_PUBLIC_KEY}
Endpoint = ${SERVER_IP}:${WG_PORT}
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
EOF

server settings for traffic redirection and firewall:

echo 'net.ipv4.ip_forward=1' | sudo tee -a /etc/sysctl.conf 1>/dev/null
sudo firewall-cmd --zone=public --add-port=${WG_PORT}/udp --permanent
sudo firewall-cmd --zone=internal --add-interface=${WG_INTERFACE} --permanent
sudo firewall-cmd --zone=public --add-rich-rule='rule family=ipv4 source address=10.0.0.0/24 masquerade' --permanent

the question is: how to SSH to Wireguard server from Windows client with active VPN connection?

Best Answer

currently I have one working solution, which seems not optimal

on client config instead AllowedIPs = 0.0.0.0/0 i put other line, where I subtract from 0.0.0.0/0 IP address of Wireguard server

why solution seems not optimal? because after IP subtraction I get a very long line that is inconvenient to read

for example my server IP address is: 100.100.200.200

for IP subtraction I must use special subnet calculator (for example: https://www.procustodibus.com/blog/2021/03/wireguard-allowedips-calculator/) to get result looking like this:

AllowedIPs = 0.0.0.0/2, 64.0.0.0/3, 96.0.0.0/6, 100.0.0.0/10, 100.64.0.0/11, 100.96.0.0/14, 100.100.0.0/17, 100.100.128.0/18, 100.100.192.0/21, 100.100.200.0/25, 100.100.200.128/26, 100.100.200.192/29, 100.100.200.201/32, 100.100.200.202/31, 100.100.200.204/30, 100.100.200.208/28, 100.100.200.224/27, 100.100.201.0/24, 100.100.202.0/23, 100.100.204.0/22, 100.100.208.0/20, 100.100.224.0/19, 100.101.0.0/16, 100.102.0.0/15, 100.104.0.0/13, 100.112.0.0/12, 100.128.0.0/9, 101.0.0.0/8, 102.0.0.0/7, 104.0.0.0/5, 112.0.0.0/4, 128.0.0.0/1

do you know other, more simple solution?

Related Topic