Raspberry PiでWireGuardを使用する - NATの問題

Pi-OSがインストールされているRaspberry Pi 3BでWireGuardを実行しようとしましたが、NATが機能しません。

WireGuardを起動すると、次の結果が表示されます。

root@raspberrypi:/home/pi# wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.10.10.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -6 route add ::/0 dev wg0 table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
root@raspberrypi:/home/pi#

iptablesは次のとおりです。

root@raspberrypi:/home/pi# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere                

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@raspberrypi:/home/pi#

ただし、wg0 10.10.10.2から192.168.188.0/24ネットワークに接続できません。どんな考えがありますか？

10.10.10.1/32 IPに接続できますが、192.168.188.0/24のどのデバイスにもpingを送信できません

パケット転送

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
net.ipv6.conf.all.forwarding=1

そして要求されたNAT

root@raspberrypi:/home/pi# iptables -t nat -vnL
Chain PREROUTING (policy ACCEPT 49 packets, 14332 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 49 packets, 14332 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 490 packets, 32962 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 427 packets, 28720 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   63  4242 MASQUERADE  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           
root@raspberrypi:/home/pi# 

IPパス出力

root@raspberrypi:/home/pi# ip route
default via 192.168.188.1 dev eth0 src 192.168.188.45 metric 202 
default via 192.168.188.1 dev wlan0 src 192.168.188.20 metric 303 
192.168.188.0/24 dev eth0 proto kernel scope link src 192.168.188.45 metric 202 
192.168.188.0/24 dev wlan0 proto kernel scope link src 192.168.188.20 metric 303 

出力ワークロード：

root@raspberrypi:/home/pi# wg
interface: wg0
  public key: Deleted
  private key: (hidden)
  listening port: 51820
  fwmark: 0xca6c

peer:deleted
  preshared key: (hidden)
  endpoint: 80.142.204.XXX:62046
  allowed ips: 0.0.0.0/0, ::/0
  transfer: 25.44 KiB received, 3.63 MiB sent

Emma Luo 更新日: 2019 年 12 月 24 日

root@raspberrypi:/home/pi# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0

root@raspberrypi:/home/pi# sysctl -a | grep net.ipv6.conf.all.forwarding
net.ipv6.conf.all.forwarding = 1