Can You route all Internet traffic through WireGuard?
It turns out that we can route all Internet traffic via WireGuard using network namespaces, rather than the classic routing table hacks.
How to create multiple routing tables in WireGuard?
Some folks prefer to use rule-based routing and multiple routing tables. The way this works is we create one routing table for WireGuard routes and one routing table for plaintext Internet routes, and then add rules to determine which routing table to use for each:
How to add a container to WireGuard route?
# ip -n container addr add 192.168.4.33/32 dev wg0 # ip netns exec container wg setconf wg0 /etc/wireguard/wg0.conf # ip -n container link set wg0 up # ip -n container route add default dev wg0 And voila, now the only way of accessing any network resources for “container” will be via the WireGuard interface.
Do you need two interfaces for WireGuard server?
If all you want to do is pass traffic from one client to the next, you don’t need two interfaces on the server, and you don’t need PostUp and PostDown route commands, either.
How to push routes and DHCP options to WireGuard?
In this case the configuration for the client AllowedIPs = 100.64.0.0/10, 192.168.178.0/24 sets routes on the client to send everything for 100.64.0.0/10 and 192.168.178.0/24 into the wireguard tunnel but nothing else. (Ip forwarding and masquerading is also activated on the WireGuard server.)
How to stop WireGuard from messing up your routing table?
This deleted the route which will be created everytime wireguard restarts . This needs to be done for all subnets that ARE NOT VPN subnets and shall not be overridden. EDIT: You can just add Table=off to your /etc/wireguard/wg0.conf and WireGuard will stop messing up your routing table 🙂 All in all a quite nerve-wracking experience.
Is there a Linux router between host and WireGuard?
P.S. On the picture, between host A and Wireguard server, there is another linux router (a main router), so please keep in mind that. After so many try and fail and brainstorming with wireguard IRC chanel guys, apparently I forgot to add a static route for 10.7.0.0/24 for each server behind wireguard.