2

I have a machine C which I can SSH into from my machine B. But when C uses Wireguard to connect to the internet through machine A, I no longer can SSH into it from B. What do I do?

2 Answers 2

1

That's because now you are no longer on the private network you have created 10.0.0.x .

You have two option one ssh machine B from machine A , or wireguard machine C with B to and ssh
then you have to enable ip forwarding:

# echo 1 > /proc/sys/net/ipv4/ip_forward
# /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# /sbin/iptables -A FORWARD -i eth0 -o wg0 -m state --state RELATED,ESTABLISHED 
 -j ACCEPT
# /sbin/iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT

Now you can ssh from C

References IP forwarding , NAT.

0

This is one of the first results on Google for "wireguard ssh can't connect" for me, so here's a blunt fix that will work. Run this on the ssh server before connecting it to the wireguard server:

ip route add <ssh_client_pub_ip> via <ssh_server_default_gateway> dev <ssh_server_pub_interface>

ssh_client_pub_ip - ssh client's public ip address, you can get it with curl ifconfig.me

ssh_server_pub_interface - name of the public interface. As long as you've only got one network interface you should be able to do ip route show default | awk '{ print $5; exit }', but if not you're pretty safe to hardcode this as its unlikely to change

ssh_server_default_gateway - ssh server (wireguard client) public interface's default gateway. You can get this with ip route | grep default | awk '{print $3}'

You are now able to connect to the wireguard peer with AllowedIps to 0.0.0.0/0 and not lose your SSH connection! This works because this command adds a static route to your ssh client via the default gateway, then when wireguard adds its rules to direct traffic to all IPs, there is an exception for traffic going to your ssh client.

You could put a reverse proxy in front of it and be done but at the very least you can SSH in without issue while you troubleshoot. I came across this much simpler fix while using the wireguard AllowedIPs calculator here, which while also providing a super handy calculator to help you exclude addresses from AllowedIPs, also recommends you consider adding a static route for traffic to your SSH client first to see if that fixes it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .