Messages

Hello folks

I use a virtual opnsense in my proxmox environment to manage my virtual routing. Since I am behind a CGNAT, I have to take a route via a VPS for services that are publicly accessible. Currently, I use a VPS with a public IP and establish a wireguard connection with the opnsense. Then I route required ports such as 443 directly with iptables via wireguard to my opnsense. There, I route these ports to my VMs via nat rules in opnsense. I used SNAT to see the real IPs of the clients on the VMs. This also works, but I have a problem; when I set up the wireguard tunnel, the opnsense then routes all ipv4 traffic via wireguard, which causes problems. Local VMs can then no longer connect to the internet and all traffic from the opn sense is then routed via the VPS. I must specify 0.0.0.0/0 for allowed IP, as all IPs are forwarded via SNAT. Does anyone have an elegant way to forward the required ports with original IPs to my VMs via wireguard without routing the entire ipv4 traffic via wireguard?


One workaround is to run a separate VM for wireguard and then add my internal subnet as a static route and route directly via iptables, but then I don't get it to work to see the original IPs of the clients. Maybe someone has an idea?


Here is the routing from the VPS:
PostUp = iptables -A FORWARD -i eth0 -o wg0 -j ACCEPT
PostUp = iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT

#HTTPS
PostUp = iptables -t nat -A PREROUTING -i eth0 -p tcp -m multiport --dport 443 -j DNAT --to 192.168.4.2

PostUp = iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source x.x.x.x (public_ip_vps)

PostDown = iptables -D FORWARD -i eth0 -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -o eth0 -j ACCEPT

#HTTPS
PostDown = iptables -t nat -D PREROUTING -i eth0 -p tcp -m multiport --dport 443 -j DNAT --to 192.168.4.2

PostDown = iptables -t nat -D POSTROUTING -o eth0 -j SNAT --to-source x.x.x.x (public_ip_vps)

Hallo zusammen :)

Ich habe ein kleines Problem und brauche eure Hilfe. Da ich keine Public IP habe, ist meine opnsense mit einem wireguard tunnel zum VPS verbunden. Der VPS leitet den Traffic der Ports, die ich benötige, direkt an die opnsense weiter. Die opnsense leite diese dann über NAT rules an meine VMs weiter. Das funktioniert alles super, jedoch sehe ich in den Logs auf den VMs bei verbunden Clients z.B. das immer nur die WireGuard IP des VPS geloggt werden und nicht die wirklichen IPs die über den VPS hineinkommen. Bei der NAT rule habe ich NAT reflection aktiviert, auch in den Settings ist automatic outbound NAT for Reflection aktiviert. Habe ich hier einen Denkfehler oder wie ist es möglich, dass die richtigen IPs an der VM ankommen? Sonst kann ich z. B. kein fail2ban konfigurieren, da ja automatisch alle Clients gesperrt werden.

Liebe Grüsse

Meni

Holy shit I found the solution , I had a old wg0 interface on my vm with the webserver. I think this was blocking the fowarding? But how? I removed now wireguard form my vm (192.168.1.103) and everything works perfekt now. Thats crazy I was searching for days for the issue, I think I need a short break XD.

Then I have another question, how can I best enable access to the vms via ssh from my host (192.168.8.2)? So far this is not possible. Do you have any other suggestions for improving my setup?

Hello everyone and a happy new year

I need your help with my homeserver because I can't get opnsense to forward the traffic to a VM.

My setup:
I have a physical server with debian 12 and proxmox. This is connected to a router which is connected to the internet through a CGNAT. As I am behind a CGNAT I have to use a public IP via a VPS. I isolate my host system with Proxmox and opnsense. Using Wiregurad, the virtual opnsense establishes a tunnel to the VPS. The VPS sends the required ports directly to the opnsense, which works perfectly. It is important to note that I only have one physical NIC. So I use the physical NIC with a linux bridge (vmbr0) for the WAN and a virtual bridge (vmbr1) for the LAN connection at opnsense.

Infa:


My problem:
The traffic e.g. 80/443 arrives on my opn sense. For example, I can access the webui of opnsense for test purposes from the public ip by forwarding80/443. But now when I create a NAT rule which should forward the traffic from the opnsense to a vm with a ngix webserver this does not work and I have no idea why not. Of course I changed the opnsense oprt from 443 to 441.

I proceed as follows:
I create a NAT rule:
Interface: OPT1 (WG)
Destination: OPT 1 net
Connection range: 80/443 to 80/443
Redirected destination IP: 192.168.1.103
Redirected carry port 80/443
NAT reflection: activate

Log:


Do I have a fundamental misconception here? Maybe one of you has an idea what I am doing wrong here. What else do you think about the construction of my network, do you think this is a secure approach or do you have any suggestions for optimization?

Thank you in advance.

best regards meni