Possible backwards iptables config example

[akeym]

When using your examples I found something that I think is wrong (but not entirely sure about). In the client configuration, I think the interfaces in the iptables post up/down section are swapped. For me, when I changed this:

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o INTERNAL_IP_INTERFACE -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o INTERNAL_IP_INTERFACE -j MASQUERADE

to

PostUp = iptables -A FORWARD -i INTERNAL_IP_INTERFACE -j ACCEPT; iptables -t nat -A POSTROUTING -o %i -j MASQUERADE
PostDown = iptables -D FORWARD -i INTERNAL_IP_INTERFACE -j ACCEPT; iptables -t nat -D POSTROUTING -o %i -j MASQUERADE

My other clients on the client subnet could then have a static route like you mention at the end of the Readme ("another host" option) and actually reach the server subnet. Before I swapped those interface names around, only the client running Wireguard could reach the server subnet and would not route traffic for the other clients on the subnet.

In any case, thank you for putting this information out, I found it helpful!

[mjtechguy]

Possible that I documented my config backwards. I will review soon and update the config / this issue. Thanks for testing and pointing this out @akeym .

[gimpfenlord]

for me doin

PostUp   = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

on both sides worked