Pi-OSがインストールされているRaspberry Pi 3BでWireGuardを実行しようとしましたが、NATが機能しません。
WireGuardを起動すると、次の結果が表示されます。
root@raspberrypi:/home/pi# wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.10.10.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -6 route add ::/0 dev wg0 table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
root@raspberrypi:/home/pi#
iptablesは次のとおりです。
root@raspberrypi:/home/pi# iptables --list
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@raspberrypi:/home/pi#
ただし、wg0 10.10.10.2から192.168.188.0/24ネットワークに接続できません。どんな考えがありますか？
10.10.10.1/32 IPに接続できますが、192.168.188.0/24のどのデバイスにもpingを送信できません
パケット転送
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
# Uncomment the next line to enable packet forwarding for IPv6
# Enabling this option disables Stateless Address Autoconfiguration
# based on Router Advertisements for this host
net.ipv6.conf.all.forwarding=1
そして要求されたNAT
root@raspberrypi:/home/pi# iptables -t nat -vnL
Chain PREROUTING (policy ACCEPT 49 packets, 14332 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 49 packets, 14332 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 490 packets, 32962 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 427 packets, 28720 bytes)
pkts bytes target prot opt in out source destination
63 4242 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
root@raspberrypi:/home/pi#
IPパス出力
root@raspberrypi:/home/pi# ip route
default via 192.168.188.1 dev eth0 src 192.168.188.45 metric 202
default via 192.168.188.1 dev wlan0 src 192.168.188.20 metric 303
192.168.188.0/24 dev eth0 proto kernel scope link src 192.168.188.45 metric 202
192.168.188.0/24 dev wlan0 proto kernel scope link src 192.168.188.20 metric 303
出力ワークロード：
root@raspberrypi:/home/pi# wg
interface: wg0
public key: Deleted
private key: (hidden)
listening port: 51820
fwmark: 0xca6c
peer:deleted
preshared key: (hidden)
endpoint: 80.142.204.XXX:62046
allowed ips: 0.0.0.0/0, ::/0
transfer: 25.44 KiB received, 3.63 MiB sent
Emma Luo 更新日: 2019 年 12 月 24 日
root@raspberrypi:/home/pi# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0
root@raspberrypi:/home/pi# sysctl -a | grep net.ipv6.conf.all.forwarding
net.ipv6.conf.all.forwarding = 1