Wireguard behind NAT

Wireguard behind NAT

[Adrián Mihálko]

[-- Attachment #1: Type: text/plain, Size: 418 bytes --]

Is there any way to connect to Wireguard behind a Carrier-grade NAT? I have
a backup LTE connection, without proper public ip + I have a home server
with Wireguard.

SIDE_A = LTE connection, without public IP, NAT
SIDE_A_SERVER = WIREGUARD (connecting to sideb.dyndns.org)

SIDE_B = VDSL with public ip + ddns (sideb.dyndns.org)
SIDE_B_SERVER = WIREGUARD (cannot connect to SIDE_A, no public ip)

Best regards,
Adrian

[-- Attachment #2: Type: text/html, Size: 618 bytes --]

Re: Wireguard behind NAT

[Jason A. Donenfeld]

If you can have SIDE_A connect to SIDE_B and enable
persistent-keepalive, that should take care of things mostly. If you
can't do that for whatever reason, there are hole punching tricks like
[1] and [2].

[1] https://git.zx2c4.com/WireGuard/tree/contrib/examples/nat-hole-punching
[2] https://github.com/manuels/wireguard-p2p

Wireguard behind NAT

[Adrián Mihálko]

[-- Attachment #1: Type: text/plain, Size: 483 bytes --]

Is there any way to connect to Wireguard behind a Carrier-grade NAT?

On SIDE_A I have a backup LTE connection, without proper public ip, only
dynamic ip and I server with Wireguard.

SIDE_A = mobile LTE connection, without public IP, behind carrier grade NAT
SIDE_A_SERVER = WIREGUARD (connecting to sideb.dyndns.org)

SIDE_B = VDSL with public ip + ddns (sideb.dyndns.org)
SIDE_B_SERVER = WIREGUARD (cannot connect to SIDE_A, because no public ip
on SIDE_A)


Best regards,
Adrian

[-- Attachment #2: Type: text/html, Size: 735 bytes --]

Re: Wireguard behind NAT

[Jason A. Donenfeld]

https://git.zx2c4.com/WireGuard/tree/contrib/examples/nat-hole-punching

Re: Wireguard behind NAT

[Steven Honson]

[-- Attachment #1: Type: text/plain, Size: 1462 bytes --]

Hi Adrian,

As SIDE_B has a public IP address, the example you give should work fine. In this case, SIDE_A will establish a connection with SIDE_B which effectively punches a NAT hole for return traffic from SIDE_B to SIDE_A.

When configuring the SIDE_A peer on SIDE_B, just leave EndPoint unset.

Inversely, when configuring the SIDE_B peer on SIDE_A, use the dynamic DNS name (and the port that SIDE_B is listening on).

The NAT Hole Punching example Jason provided is more applicable to situations where both WireGuard peers are NATed. In your example it sounds like this is only the case for SIDE_A.

Cheers,
Steven

> On 3 Sep 2018, at 5:51 am, Adrián Mihálko <adriankoooo@gmail.com> wrote:
> 
> Is there any way to connect to Wireguard behind a Carrier-grade NAT? 
> 
> On SIDE_A I have a backup LTE connection, without proper public ip, only dynamic ip and I server with Wireguard. 
> 
> SIDE_A = mobile LTE connection, without public IP, behind carrier grade NAT 
> SIDE_A_SERVER = WIREGUARD (connecting to sideb.dyndns.org <http://sideb.dyndns.org/>) 
> 
> SIDE_B = VDSL with public ip + ddns (sideb.dyndns.org <http://sideb.dyndns.org/>) 
> SIDE_B_SERVER = WIREGUARD (cannot connect to SIDE_A, because no public ip on SIDE_A) 
> 
> 
> Best regards, 
> Adrian
> _______________________________________________
> WireGuard mailing list
> WireGuard@lists.zx2c4.com
> https://lists.zx2c4.com/mailman/listinfo/wireguard


[-- Attachment #2: Type: text/html, Size: 2607 bytes --]

Wireguard behind NAT

[Adrián Mihálko]

[-- Attachment #1: Type: text/plain, Size: 596 bytes --]

Is there any way to connect to Wireguard behind a Carrier-grade NAT?

On SIDE_A I have a backup LTE connection, without proper public ip, only
dynamic ip and I server with Wireguard.

SIDE_A = mobile LTE connection, without public IP, behind carrier grade NAT
SIDE_A_SERVER = WIREGUARD (connecting to sideb.dyndns.org)

SIDE_B = VDSL with public ip + ddns (sideb.dyndns.org)
SIDE_B_SERVER = WIREGUARD (cannot connect to SIDE_A, because no public ip
on SIDE_A)

I heard of Wireguard-P2P, but it's not running on headless server, because
one of their component requires x11.


Best regards,
Adrian

[-- Attachment #2: Type: text/html, Size: 1919 bytes --]

Re: Wireguard behind NAT

[Ole-Morten Duesund]

On 9/3/18 12:28 PM, Adrián Mihálko wrote:
> Is there any way to connect to Wireguard behind a Carrier-grade NAT?
> 
> On SIDE_A I have a backup LTE connection, without proper public ip, only 
> dynamic ip and I server with Wireguard.
> 
> SIDE_A = mobile LTE connection, without public IP, behind carrier grade NAT
> SIDE_A_SERVER = WIREGUARD (connecting to sideb.dyndns.org 
> <http://sideb.dyndns.org/>)
> 
> SIDE_B = VDSL with public ip + ddns (sideb.dyndns.org 
> <http://sideb.dyndns.org/>)
> SIDE_B_SERVER = WIREGUARD (cannot connect to SIDE_A, because no public 
> ip on SIDE_A)
> 
> I heard of Wireguard-P2P, but it's not running on headless server, 
> because one of their component requires x11.

This is pretty much the same as I have - and while SIDE_B_SERVER won't 
be able to establish connection to SIDE_A_SERVER, SIDE_A_SERVER should 
have no problems establishing a connection to SIDE_B_SERVER.

Adding a "PersistentKeepalive = 5" to your config on SIDE_A_SERVER 
should keep the connection up.

- OM

Re: Wireguard behind NAT

[Roman Mamedov]

On Mon, 3 Sep 2018 12:43:19 +0200
Ole-Morten Duesund <olemd@glemt.net> wrote:

> Adding a "PersistentKeepalive = 5" to your config on SIDE_A_SERVER 
> should keep the connection up.

Do you encounter any difference between 5, 25 and 55, only 5 works for you? If
not, setting it to such a low interval seems wasteful, especially on
LTE/mobile with possibly metered bandwidth and battery concerns.

-- 
With respect,
Roman

Re: Wireguard behind NAT

[Ole-Morten Duesund]

On 9/3/18 12:55 PM, Roman Mamedov wrote:
> On Mon, 3 Sep 2018 12:43:19 +0200
> Ole-Morten Duesund <olemd@glemt.net> wrote:
> 
>> Adding a "PersistentKeepalive = 5" to your config on SIDE_A_SERVER
>> should keep the connection up.
> 
> Do you encounter any difference between 5, 25 and 55, only 5 works for you? If
> not, setting it to such a low interval seems wasteful, especially on
> LTE/mobile with possibly metered bandwidth and battery concerns.

"It works for me?" It's a balance between how long you're willing to 
wait for a possibly idle link if you need to connect from SIDE_B to SIDE_A.

It's tunable and you should probably test what's acceptable to you.

- OM