☰

启动 Wireguard 后无法使用其公共 IP 访问服务器上的服务

tag-icon • tag-icon debian services wireguard
启动 Wireguard 后无法使用其公共 IP 访问服务器上的服务

如果我将 Debain 服务器设置为 Wireguard 客户端，我将无法再从本地网络外部（使用其公共 IP）连接到服务器上运行的服务。从本地网络，一旦我停止 Wireguard 连接，一切都会正常工作。 tcpdump 日志显示请求全部到达服务器。

wg0.conf：

[Interface]
PrivateKey = ...
Address = 100.64.67.64/32
DNS = 127.0.0.1

[Peer]
PublicKey = ...
AllowedIPs = 0.0.0.0/0
Endpoint = ...
PresharedKey = ...

wg-quick up wg0:

[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 100.64.67.64/32 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
[#] iptables-restore -n

ip -4 rule show table 51820:

32765:  not from all fwmark 0xca6c lookup 51820

wg-quick down wg0:

[#] ip -4 rule delete table 51820
[#] ip -4 rule delete table main suppress_prefixlength 0
[#] ip link delete dev wg0
[#] resolvconf -d wg0 -f
[#] iptables-restore -n

答案1

我想到了。问题当然是请求进入 eth0，但响应是通过 Wireguard 隧道 (wg1) 发送的，并且使用不同的 IP 到达客户端：

Request: Client -> Internet -> Router [NAT] -> Server  
Response: Server -> Router [NAT] -> Internet -> VPN Provider [NAT] -> Internet -> Client

因此，在这些情况下，您需要通过添加规则来使用主路由表来绕过 VPN 隧道：

ip rule add from <interface IP> lookup main

例子：

$ ip a
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether b8:27:ed:fc:a5:65 brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.2/24 brd 192.168.0.255 scope global noprefixroute eth0
       valid_lft forever preferred_lft forever

$ ip rule add from 192.168.0.2 lookup main

$ ip route show table main
default via 192.168.0.1 dev eth0 src 192.168.0.2 metric 202
192.168.0.0/24 dev eth0 proto dhcp scope link src 192.168.0.2 metric 202

$ ip rule show
0:      from all lookup local
32756:  from 192.168.178.2 lookup main
32761:  from all lookup main suppress_prefixlength 0
32762:  not from all fwmark 0xca6c lookup 51820
32766:  from all lookup main
32767:  from all lookup default

就我而言，它想要从本地网络外部访问的服务是 Wireguard 服务器。为了使 Wireguard 客户端能够访问本地网络和互联网，您还必须添加以下规则：

ip rule add from <Wireguard IP range> lookup main

例子：

$ ip a
11: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 10.6.0.1/24 scope global wg0
   valid_lft forever preferred_lft forever

$ ip rule add from 10.6.0.1/24 lookup main

相关内容