Wireguard VPN – Can’t Access Internet and LAN

routingUbuntuvpnwireguard

I have a server running Ubuntu 20.04 and wireguard 1.0.20200513-1~20.04.2. I installed the wireguard app on my phone (Android Samsung S20+) and disabled WIFI and connected to 4G. When the VPN is active I can access the server and nothing else on my home network (192.168.1.X) or the internet. The server has a 10.0.0.1 (VPN) and 192.168.1.171 (LAN) interface. The phone gets a 10.0.0.2 interface. I'm guessing I need to setup a route. Server firewall (ufw status) is inactive. Any help would be much appreciated.

/etc/wireguard/wg0.conf

[Interface]
Address = 10.0.0.1/24
Address = <MAC>::1/64
SaveConfig = true    
ListenPort = 51820
PrivateKey = <SERVER_KEY>

[Peer]
PublicKey = <CELL_PUB_KEY>
AllowedIPs = 10.0.0.2/32, 
Endpoint = <EXTERNAL_IP>:8598

Client Config

Cellphone config
[Interface]
PrivateKey =<CELL_KEY>
Address = 10.0.0.2/24
DNS = 1.1.1.1, 1.0.0.1

[Peer]
PublicKey = <SERVER_PUB_KEY>
AllowedIPs = 10.0.0.0/24, 192.168.1.0/24
Endpoint = <EXTERNAL_IP>:51820

/etc/sysctl.conf

net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

route -n

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.1.1     0.0.0.0         UG    100    0        0 enp2s0
10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 wg0
169.254.0.0     0.0.0.0         255.255.0.0     U     1000   0        0 enp2s0
192.168.1.0     0.0.0.0         255.255.255.0   U     100    0        0 enp2s0

On the server

ip route get from 10.0.0.2 iif wg0 192.168.1.1
192.168.1.1 from 10.0.0.2 dev enp2s0
    cache iif wg0

EDIT – Solution – Needed PostUp and PostDown lines in wireguard.conf:

[Interface]
Address = 10.0.0.1/24
SaveConfig = true
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE
ListenPort = 51820
PrivateKey = <MY_KEY>

[Peer]
PublicKey = <MY_PUB_KEY>
AllowedIPs = 10.0.0.2/32

Best Answer

Needed PostUp and PostDown lines in wireguard.conf:

[Interface]
Address = 10.0.0.1/24
SaveConfig = true
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE
ListenPort = 51820
PrivateKey = <MY_KEY>

[Peer]
PublicKey = <MY_PUB_KEY>
AllowedIPs = 10.0.0.2/32

Related Solutions

VPN Router – VPN Router Not Replying to ARP Requests

The solution was to replace
/sbin/ip rule add from 192.168.0.0/24 table 200
with
ip rule add iif eth1 table 200
We dont want only packets from 192.168.0.0/24 to use routing table 200 but every packet from interface eth1.

Ubuntu VPN – Troubleshooting WireGuard VPN Setup Issues

Well, in several of days, nights, and killed servers, I solved all the problems myself :)

Firstly, I'd like to mention that wg and wg-quick utilities treats config files differently. So, my wg setconf wg0 /etc/wireguard/wg0.conf didn't work the expected way, and I guess it uses old config format. Now I use wg-quick through systemctl.
Secondly, my addition of net.ipv4.ip_forward=1 to the file /etc/sysctl.conf didn't work even though I called systemctl daemon-reload ; systemctl restart systemd-networkd. I had to link config with the kernel using sysctl -p /etc/sysctl.conf command. This allows peers to communicate with each other and reach the Internet through VPN.
It's good to mention that for all the Address notes it's better to use subnet mask of 32 bits, which means an exact IP, not a range.
In addition, I've set up custom DNS with BIND9 to create own domain in the network. And NginX with sender's IP address checking to restrict access to VPN's clients only.

For now, my configs are as follows.

Server

[Interface]
Address = 10.0.0.1/32
ListenPort = 5555
PrivateKey = ___some_private_key___

# The following is needed only if you have `ufw` installed
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = ___some_public_key___
AllowedIPs = 10.0.0.1/32

Client

[Interface]
PrivateKey = ___some_private_key___
ListenPort = 5555
Address = 10.0.0.1/32

[Peer]
PublicKey = ___some_public_key___
AllowedIPs = 10.0.0.0/24
Endpoint = ___some_ip_address__:5555