Router Packets from One WireGuard Client to Another Using iptables

Introduction

In this article, we will guide you through the process of setting up a One-Wire Guard VPN client on two Raspberry Pi devices, connected via a local network, and a VPS. We will use iptables to forward traffic between the Raspberry Pi devices and the VPS.

Prerequisites

Before we begin, ensure the following prerequisites are met:

Two Raspberry Pi devices connected to a local network.
A VPS with a publicly accessible IP address.
OpenVPN and One-Wire Guard installed on both Raspberry Pi devices and the VPS.
Basic knowledge of Linux command line and network configuration.

Configuration on Raspberry Pi 1

Step 1: Configure OpenVPN Server on Raspberry Pi 1

Set up the OpenVPN server on Raspberry Pi 1 with the following configuration:


 server 192.168.1.174 255.255.255.0
 port 1194
 proto udp
 dev tun
 ca ca.crt
 cert server.crt
 key server.key
 dh dh2048.pem
 server-bridge 10.8.0.0 255.255.255.0 192.168.1.0 255.255.255.0
 ifconfig-pool-persist ipp.txt
 push "redirect-gateway def1 bypass dns"
 push "dhcp-option DNS 8.8.8.8"
 push "dhcp-option DNS 8.8.4.4"
 keepalive 10 120
 tls-auth ta.key 0 # This file is secret
 cipher AES-256-CBC
 auth SHA256
 comp-lzo

Step 2: Configure iptables on Raspberry Pi 1

Set up iptables to forward traffic from Raspberry Pi 1 to the VPS:


 iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE
 iptables -A FORWARD -i eth0 -o tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
 iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT

Configuration on Raspberry Pi 2

Step 1: Configure OpenVPN Client on Raspberry Pi 2

Set up the OpenVPN client on Raspberry Pi 2 with the following configuration:


 client
 dev tun
 proto udp
 remote 192.168.1.174 1194
 resolv-retry infinite
 nobind
 persist-key
 persist-tun
 ca ca.crt
 cert client.crt
 key client.key
 cipher AES-256-CBC
 auth SHA256
 comp-lzo

Step 2: Configure One-Wire Guard on Raspberry Pi 2

Set up One-Wire Guard on Raspberry Pi 2 with the following configuration:


 [Interface]
 PrivateKey = client.key
 Address = 10.8.0.110/24
 PostUp = iptables -A FORWARD -i %i -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -A FORWARD -i eth0 -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 PostDown = iptables -D FORWARD -i %i -o eth0 -j ACCEPT; iptables -D FORWARD -i eth0 -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

Configuration on VPS

Set up the OpenVPN server on the VPS with the following configuration:


 server 10.8.0.1 255.255.255.0
 port 1194
 proto udp
 dev tun
 ca ca.crt
 cert server.crt
 key server.key
 dh dh2048.pem
 server-bridge 10.8.0.0 255.255.255.0 0.0.0.0 0.0.0.0
 ifconfig-pool-persist ipp.txt
 push "redirect-gateway def1 bypass dns"
 push "dhcp-option DNS 8.8.8.8"
 push "dhcp-option DNS 8.8.4.4"
 keepalive 10 120
 tls-auth ta.key 0 # This file is secret
 cipher AES-256-CBC
 auth SHA256
 comp-lzo

Testing

Test the VPN connection by pinging from Raspberry Pi 1 to Raspberry Pi 2 using their respective IP addresses. The ping should be successful.