Open akeym opened 4 years ago
Possible that I documented my config backwards. I will review soon and update the config / this issue. Thanks for testing and pointing this out @akeym .
for me doin
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
on both sides worked
When using your examples I found something that I think is wrong (but not entirely sure about). In the client configuration, I think the interfaces in the iptables post up/down section are swapped. For me, when I changed this:
to
My other clients on the client subnet could then have a static route like you mention at the end of the Readme ("another host" option) and actually reach the server subnet. Before I swapped those interface names around, only the client running Wireguard could reach the server subnet and would not route traffic for the other clients on the subnet.
In any case, thank you for putting this information out, I found it helpful!