wireguard. Route packets from a NAT-ed network into wireguard.

diff --git a/wireguard-for_NATed_network/rules.v4 b/wireguard-for_NATed_network/rules.v4
new file mode 100644 (file)
index 0000000..213689a
--- /dev/null
+++ b/wireguard-for_NATed_network/rules.v4
@@ -0,0 +1,23 @@
+*mangle
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+
+# Restore packet mark on incoming packets from connection mark.
+-A PREROUTING -m connmark --mark 0x4 -j CONNMARK --restore-mark --nfmask 0xffffffff --ctmask 0xffffffff
+
+# Mark transit (forwarded) packets, which i need to forward to wireguard.
+-A PREROUTING -s 192.168.4.1/32 -i br0 -m conntrack --ctstate NEW -j MARK --set-xmark 0x4/0xffffffff
+# Copy transit packet mark to connection mark.
+-A PREROUTING -m mark --mark 0x4 -j CONNMARK --save-mark --nfmask 0xffffffff --ctmask 0xffffffff
+COMMIT
+
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+-A POSTROUTING -s 192.168.4.0/24 -j MASQUERADE
+COMMIT

diff --git a/wireguard-for_NATed_network/wg4.conf b/wireguard-for_NATed_network/wg4.conf
new file mode 100644 (file)
index 0000000..5155d8f
--- /dev/null
+++ b/wireguard-for_NATed_network/wg4.conf
@@ -0,0 +1,25 @@
+[Interface]
+PrivateKey = ...
+Address = 10.10.238.146
+
+Table = off
+
+# Add table for routing marked packets into wireguard.
+PostUp = ip rule add pref 444 fwmark 4 table 444
+# Default route to wireguard.
+PostUp = ip ro add default dev wg4 table 444
+# Route replies back to sender. Otherwise, they'll be looped back to
+# wireguard.
+PostUp = ip ro add 192.168.4.0/24 dev br0 table 444
+
+# Undo all changes.
+PreDown = ip rule del pref 444 fwmark 4 table 444
+PreDown = ip ro del default dev wg4 table 444
+PreDown = ip ro del 192.168.4.0/24 dev br0 table 444
+
+[Peer]
+Endpoint = ...
+PublicKey = ...
+
+AllowedIPs = 0.0.0.0/0
+PersistentKeepalive = 25