All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.
[help] Wireguard can't reach one peer behind NAT
I am trying to set up wireguard between my desktop PC behind NAT and a VPS. On the server I run apt install wireguard. On the desktop PC I run the official Windows client.
The configuration is easy, and my PC (10.8.0.3) connects just fine to the server (10.8.0.2) and sends the keepalive thing. I can then log into my server with ssh [email protected], including from WSL.
- However, I cannot reach 10.8.0.3 from my VPS.
- I can ping 10.8.0.3 from Windows CMD.
- I cannot ping 10.8.0.3 from WSL, even though it is supposed to be my local IP, and even though I can reach the VPS (10.8.0.2) from WSL just fine.
I tested the setup on two VPS's and they can reach each other just fine.
edit:It works when connecting from WSL, but then I don't have the network access in Windows 10 (play games over LAN and so on)
What could be the reason for that? My PC is behind NAT, and unfortunately port forwarding does not work. So "wg" on the VPS shows my home IP and a random port. But all sources on the Internet claim it should work fine with one device behind NAT and with keepalive enabled.
The PC config:
[Interface]
PrivateKey = PCprivatekey
Address = 10.8.0.3/32
ListenPort = 52345
[Peer]
PublicKey = VPSpublickey
PresharedKey = psk
AllowedIPs = 10.8.0.0/24
Endpoint = VPSIP:52345
PersistentKeepalive = 5
The VPS config:
[Interface]
PrivateKey = VPSprivatekey
Address = 10.8.0.2/32
ListenPort = 52345
[Peer]
PublicKey = PCpublickey
PresharedKey = psk
AllowedIPs = 10.8.0.0/24
Endpoint = myhomeIP:52345
PersistentKeepalive = 5
Comments
inside server wg0, there should be only 3 line if you're behind nat
nyr/wireguard-install handle this automatically, recomended to use if you want it easy
Thanks. I tried that, too, just now, but it does not change anything. I also edited my post to include that it does work in WSL.
Unfortunately, I cannot edit the post anymore.
The title should now read: "Windows 10 wireguard client unreachable, but it works in WSL"
The default Windows Firewall configuration drops ICMP on the public profile, either spin up a new rule or change the WG interface's profile.
tcpdumpandnmapare your friends here.Thanks to your comment I disabled my firewall, and now the server<->client connection works, including accessing my home PC from another client VPS.
Now I just need to figure out how to access anything inside WSL (nginx in Windows 10 works, nginx in WSL is accessible under 127.0.0.1 but not 10.8.0.3). Or maybe I'll just connect from both, Win10 and WSL with two different IPs...
Thanks so much.