multi-hop gateway in wireguard (hub and spoke)

https://www.procustodibus.com/blog/2022/06/multi-hop-wireguard/#internet-gateway-as-a-spoke 

routovani default routy skrz wireguard mezi peerama:

on the client, 172.20.24.15 set 

wg0.conf
[Interface] ... Address = 172.20.24.15/32
[Peer] ... AllowedIPs = 0.0.0.0/0 

ip route add wg_server_ip via 192.168.122.1 dev eth0
ip route add default via 172.20.24.10 dev wg0 

 

on the gateway, 172.20.24.10 

iptables -t nat -A POSTROUTING -s 172.20.24.0/24 -o vlan2 -j MASQUERADE
(a mozna i neco z toho:
iptables -t nat -A POSTROUTING -o oet1 -j MASQUERADE
iptables -A FORWARD -i oet1 ...? ) 

(list:  iptables -t nat -S POSTROUTING )

on the hub (wg server) 172.20.24.1 

wg:
wg set wg2 peer rdwrtQdE7Z0SqZcJmoydFD74vXLLTnf+gk9go5pDWRw= allowed-ips 0.0.0.0/0 (namisto 172.20.24.10/24) (klic je klienta gateway) 

routing:
echo "123 wgfrompeer" >> /etc/iproute2/rt_tables #tim se nastavi jen jmeno
ip route add default via 172.20.24.10 dev wg2 table 123
ip rule add iif wg2 table 123 priority 100

(list:  ip route show table 123 , ip rule show )

 

firewall:
# neco z tohodle:
sysctl -w net.ipv4.ip_forward=1 (to uz je zrejme jako default)
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wg2 -s 172.20.24.0/24 -j ACCEPT
iptables -I FORWARD -i wg2 -o wg2 -j ACCEPT