ARP Proxy second IP of VPS to route it over Wireguard

Question

I have set up an ARP Proxy on my VPS. With this Setup, I can route incoming traffic on the second IP of my VPS over WireGuard. This should allow my Raspberry Pi at home to use the second Public IP.

I got this kind of working. Incoming Pings are forwarded over the WireGuard Tunnel to the Pi. But the Pi then tries to answer the Ping via eth0. Is there a way to fix this, so it sends the reply Packets also over the WireGuard Interface?

To show this Problem (Both on the Raspberry Pi)

WireGuard Interface:

    # tcpdump -i wg_pub
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on wg_pub, link-type RAW (Raw IP), capture size 262144 bytes
    01:35:02.796522 IP <Public ip of ping PC> > <Second VPS IP>: ICMP echo request, id 14, seq 1, length 64
    01:35:03.795359 IP <Public ip of ping PC> > <Second VPS IP>: ICMP echo request, id 14, seq 2, length 64
    01:35:04.810613 IP <Public ip of ping PC> > <Second VPS IP>: ICMP echo request, id 14, seq 3, length 64

Ethernet Interface:

    # tcpdump -i eth0 icmp
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
    01:37:11.477589 IP <Second VPS IP> > <Public ip of ping PC>: ICMP echo reply, id 14, seq 128, length 64
    01:37:12.491045 IP <Second VPS IP> > <Public ip of ping PC>: ICMP echo reply, id 14, seq 129, length 64
    01:37:13.505965 IP <Second VPS IP> > <Public ip of ping PC>: ICMP echo reply, id 14, seq 130, length 64

I would like to prevent using a private Subnet on the WireGuard Tunnel.

One way I got this working was to add a static route

ip route add <First VPS IP>/32 dev eth0

and then overwriting the default route

ip route add 0.0.0.0/0 dev wg_pub

But this has the disadvantage of routing all Internet Traffic via the VPS then.

score 0 · Answer 1 · answered Jul 23 '21 at 19:25

I think you should be able to do this with policy routing. Set up the default route for a new routing table (123 for example) to use your WireGuard interface (wg_pub):

ip route add default dev wg_pub table 123

And then add a policy rule to use that new table for all packets whose source is your Second VPS IP (say it's 192.0.2.2 for example):

ip rule add from 192.0.2.2 table 123 priority 456

Priority (456) can be anything, only matters if you have multiple matching rules (list via ip rule list).

ARP Proxy second IP of VPS to route it over Wireguard

1 Answers1