Enabling Multiple interfaces

[asankahh]

Hi Guys,

Firstly, thank you, Donald, for this amazing project.

I have switched from WG Easy to WG Dashboard since this support the multiple interfaces.

In my current setup I have a cloud VPS, running Ubuntu 24.04, and I have installed multiple applications including a pi-hole, which is used DNS on wg0. Initially I tried with only 10086 and 51820 and it worked fine. Then I wanted to have multiple interfaces for my personal devices and network devices. So I opened 4 more ports, as 51520, 51620,51720 and 51920. And created one more interface to test.
Configurations are follows

WG0 - (Working)
[Interface]
PrivateKey = [Redacted]
Address = 10.0.0.3/32
MTU = 1420
DNS = 172.17.0.7

[Peer]
PublicKey = [Redacted]
AllowedIPs = 0.0.0.0/0
Endpoint = [Redacted]:51820
PersistentKeepalive = 21

WG1 - (not working)
[Interface]
PrivateKey = [Redacted]
Address = 10.0.1.2/32
MTU = 1420
DNS = 1.1.1.1

[Peer]
PublicKey = [Redacted]
AllowedIPs = 0.0.0.0/0
Endpoint = [Redacted]:51920
PersistentKeepalive = 21

Client connect to the server using both the configurations, however, WG1 can't connect to internet while connected.

Appreciate if you could help me here.

[DaanSelen]

For the interfaces you have selected a /32 subnet, which in itself is a mask of 255.255.255.255 which leaves 1 IP. Also, how have you taken care of the routing?

[asankahh]

Hi Dan,

Thanks for the reply,

for the interface wg0 and wg1, I have selected 10.0.0.1/24 and 10.0.1.1/24 respectively,
10.0.0.3/32 and Address = 10.0.1.2/32 for the endpoints, as per my understanding, there is no reason for a single endpoint to have more than 1 IP address. And anyway it is being auto generated from the given IP address scope. Refer the below for reference

Regarding routing, I haven't done any changes, it is as it is, I do not want interfaces to communicate each other.

This maybe because of my lack of knowledge in WireGuard. If you could point me into a right direction, I will try a bit harder on my own.

[DaanSelen]

By default I suggest adding:

PostUp = iptables -t nat -I POSTROUTING 1 -s ${wg_network}/24 -o ${outgoing_adapter} -j MASQUERADE

PreDown = iptables -t nat -D POSTROUTING -s ${wg_neteork}/24 -o ${outgoing_adapter} -j MASQUERADE

Fill in the details for your situation. If you have questions specific on why or how, let me know.

Sorry for the short response, I am on mobile now.

[asankahh]

Hi Dan,

Sorry about the late reply, just got a chance to test today. modification of your iptable rules worked,
Exact commands were followings
Post Up

iptables -t nat -I POSTROUTING 1 -s ${wg_network}/24 -o ${outgoing_adapter} -j MASQUERADE; iptables -I FORWARD -i ${wg_interface} -o ${wg_interface} -j DROP

Pre Down

iptables -t nat -D POSTROUTING -s ${wg_neteork}/24 -o eth0 -j MASQUERADE; iptables -D FORWARD -i ${wg_interface} -o ${wg_interface} -j DROP

[DaanSelen]

You have a spelling error in the PreDown 😉 wg_neteork. But is your configuration working?

[asankahh]

I typed the IP address of the network there to be honest. Wasn't sure if the $ variable would work. So yes it is working.
For an example, it says

iptables -t nat -D POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE; iptables -D FORWARD -i wg5 -o wg5 -j DROP

[DaanSelen]

Nice to hear!