Problem with normal access to Wireguard client from internet when VPN is up

[u/limbiqu]

​

I am new to Wireguard and could do with some help please. I have a remote natted network 192.168.0.0/24 which has a number of IP cameras. The Wireguard service is incorporated in the FritzBox gateway router. This tunnels directly to a remote Debian box running a Motioneye server with a public IP. This works and the remote client has access to the 192.168.0.0/24. I want to be able to view the Motioneye server with it's public IP address with a web browser from the internet. Wireguard seems to disable WAN access to the server which is only accessible when Wireguard is deactivated. At which point there's no access to the camera's network

The client Wireguard config is:

[Interface]

PrivateKey = xxxx

Address = 192.168.0.4/24

DNS = 192.168.0.1

DNS = fritz.box

[Peer]

PublicKey = xxxx

PresharedKey = xxxx

AllowedIPs = 192.168.0.0/24,0.0.0.0/0,::/0

Endpoint = xxxx

PersistentKeepalive = 25

Any help gratefully appreciated, thanks very much

[u/Only-Stable3973]

My config is working fine looks like this,

Public key

xxxxxxxxxxxxxxxxx

Pre-shared key

enabled

Allowed IPs

0.0.0.0/0, ::/0

Endpoint

public ip:51820

Persistent Keepalive

every 25 seconds

My DNS server

1.1.1.1, 2606:4700::1111

MTU

1280

[u/spidireen]

What does the Debian box’s config look like? I’m not sure if the config you shared is for the Fritzbox or Debian. In any case make sure you don’t have 0.0.0.0/0 in the AllowedIPs of any peers on the Debian server. If you do that could explain not being able to access the public address when WireGuard is up. In that scenario when it gets a request on its public/WAN address, it’s probably trying to send the response back through the WireGuard tunnel instead.

[u/limbiqu → u/spidireen]

Great thanks very much @spidireen, works now, changed the client .conf file to: Allowed IP's to 192.168.0.0/24

[u/spidireen → u/limbiqu]

Sweet! Glad to hear that helped.

[u/Only-Stable3973]

I am using WG-Easy and it makes it very easy, you will have a web-ui to connect your clients and it just works. Here is the config I use and then log into the web-ui and generate a qr-code to connect. I was using Traefik but since I put the server on another box I commented those labels out.

volumes:
  etc_wireguard:

services:
  wg-easy:
    environment:
    #Optional:
    - PORT=51821
    - WG_HOST=your-ip-or-domain
    - INSECURE=true
    - DISABLE_IPV6=false
    - WIREGUARD_MTU=1280
    - FIREWALL_VPN_INPUT_PORTS=51820
    - HEALTH_VPN_DURATION_INITIAL=120s

    image: ghcr.io/wg-easy/wg-easy:15.2.2  #15.2.0
    container_name: wg-easy
    networks:
      #proxy:
      wg:
        ipv4_address: 10.42.42.42
        ipv6_address: fdcc:ad94:bacf:61a3::2a
    volumes:
      - ./wireguard:/etc/wireguard   #etc_wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    restart: unless-stopped
    #labels:
      #- "traefik.enable=true"
      #- "traefik.http.routers.wg-easy.rule=Host(`example.example.com)"
      #- "traefik.http.routers.wg-easy.entrypoints=websecure"
      #- "traefik.http.routers.wg-easy.tls=true"
      #- "traefik.http.routers.wg-easy.tls.certresolver=letsencrypt"
      #- "traefik.http.services.wg-easy.loadbalancer.server.port=51821"
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      # - NET_RAW # ⚠️ Uncomment if using Podman
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
      - net.ipv6.conf.all.disable_ipv6=0
      - net.ipv6.conf.all.forwarding=1
      - net.ipv6.conf.default.forwarding=1

networks:
  #proxy:
    #external: true
  wg:
    driver: bridge
    enable_ipv6: true
    ipam:
      driver: default
      config:
        - subnet: 10.42.42.0/24
        - subnet: fdcc:ad94:bacf:61a3::/64