I'm running a Wireguard server ("wg-home", 192.168.7.50/24) and other services at home, which I'd like to access from outside my own network.
Unfortunately, my ISP does not provide a public IP, so I'm looking for a configuration that allows me to easily connect from the Internet to inside my LAN.
My idea is to keep an active outgoing connection from inside my LAN to my VPS in which is installed another instance of Wireguard ("wg-vps"). The VPS has a direct connection to the Internet via a public address (example 91.101.144.43).
Both the wg-home and the wg-vps are running on Debian based operative systems.
The question is: how can I configure the two instances of Wireguard in order to allow me to connect to the wg-vps public endpoint and being able to reach all devices inside my LAN (192.168.7.x/24)?
Attempts made so far:
# Wireguard configuration of VPS (wg-vps) /etc/wireguard/wg-server.conf
[Interface]
Address = 10.0.0.1
ListenPort = 51820
PrivateKey = <vps_priv_key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = <raspberry_public_key>
AllowedIPs = 192.168.7.0/24
[Peer]
PublicKey = <android_pub_key>
AllowedIPs = 192.168.7.0/24
# Wireguard configuration of Raspberry Pi (wg-home) /etc/wireguard/wg-peer.conf
[Interface]
Address = 10.0.0.2
PrivateKey = <raspberry_priv_key>
ListenPort = 51820
DNS = 192.168.7.1
[Peer]
PublicKey = <public_key_of_VPS_server>
Endpoint = VPS_PUBLIC_ENDPOINT:51820
AllowedIPs = 10.0.0.0/24
PersistentKeepalive = 30
# Wireguard configuration of Android client
[Interface]
PrivateKey = <android_priv_key>
Address = 192.168.7.20/32
[Peer]
PublicKey = <pub_key_of_vps_server>
AllowedIPs = 192.168.7.0/24
Endpoint = VPS_PUBLIC_ENDPOINT:51820
PersistentKeepalive = 30
Tried this configuration but from my Android client, I can't ping any of the devices inside my LAN (192.168.7.x/24)
Where is the mistake?
Thanks in advance for your help :-)
