I have one machine in AWS EC2 running Ubuntu 16.04 (B) with Wireguard running as a VPN server for some Road Warrior devices (C).
I'll try to sketch it below:
+-----+ +-----+ +-----+
| | ---------------------------> | | -------------------------> | |
| A | 172.30.0.5/16 172.30.0.6/16 | B | 10.70.0.1/24 10.70.0.2/32 | C |
| | ens5 eth0 | | wg0 wg0 | |
+-----+ +-----+ +-----+
I want to route traffic addressed to 10.70.0.0/24 from (A) to (C) via (B).
I tried following config:
On host (A):
ip route add 10.70.0.0/24 via 172.30.0.6
EC2 security group allows all trafic to and from 172.16.0.0/12.
On host (B):
sysctl -w net.ipv4.ip_forward 1
ufw allow from 172.16.0.0/12
ufw route allow out on wg0
iptables -t nat -A POSTROUTING -s 172.16.0.0/12 -o wg0 -j MASQUERADE
I've verified forwarding is enabled for all interfaces as descibed here: https://askubuntu.com/a/923292
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.wg0.forwarding = 1
EC2 security group allows all trafic to and from 172.16.0.0/12.
I even tried setting DEFAULT_FORWARD_POLICY="ACCEPT" in /etc/default/ufw.
I'm out of ideas what else is missing here, I can't get any packets to pass through. On host (B) iptables doesn't see any packets going through its FORWARD chain:
iptables -nv -L FORWARD
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ufw-before-logging-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-before-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-after-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-after-logging-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-reject-forward all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ufw-track-forward all -- * * 0.0.0.0/0 0.0.0.0/0
