Dietpi-VPN GATEWAY with Pivpn server and Pihole

General Discussion
21

How did you come to this conclusion? The gateway is used for the wireguard server outgoing packets and not for the forwarded.

I check exit with public ip on my primary router 192.168.10.1

22

Then the tunnel was down for some reason.

23

Hi @trendy
I have insert in my VPN up script this rule:

iptables -t nat -A POSTROUTING -s 192.168.10.0/24 -o tun0 -m comment --comment >
iptables -t nat -A POSTROUTING -s 10.6.0.0/24 -o tun0 -m comment --comment wire>
ip route add to default via 192.168.10.1 table isp
ip rule add iif lo sport 51820 to default lookup isp prio 15000

and now the PC traffic on eth0 (setting 192.168.10.5 (dietpi) as the gateway on the PCs and not the 10.1 router) comes out with tun0, and the smartphone with wireguard (wg0) also comes out with tun0. DNS traffic is always covered with 10.5 (pihole+unbound), so everything is OK.
Except for this oddity:
On the 10.1 router I have two portforwarding rules:
51820 → 192.168.10.5 (wireguard server - wg0)
54936 → 192.168.10.5 (transmission torrent server)
Also on the router I have the DDNS script to access the outside (wireguard) and it also works with the tun0 VPN turned on.
Instead transmission tells me that the port is “Closed”, I can’t understand why Wireguard’s portforwarding rule works and this one doesn’t.
I hope I have explained myself.
Could you help me? Thanks

24

When you turn the VPN on then all traffic from the DietPi goes through the VPN, hence the port forwarding on the router will no longer take effect. You will have to setup the port forwarding at the VPN provider, if it is supported.

25

Ok,
But i don’t understand because the portforwarding for vpn wireguard work
In a router:
Port In 58120 (wg0) → 192.168.10.5 (dietpi)
In the router i have the ddns active and exit with main IP (verified on site’s ddns provider)

And this work also with VPN Proton active on DietPi Transmission

This rule:

ip route add to default via 192.168.10.1 table isp
ip rule add iif lo sport 51820 to default lookup isp prio 15000

was modified also for transmission port? what is it for?

26

Because you have added the rule to send Wireguard server traffic via the ISP.

ip route add to default via 192.168.10.1 table isp
ip rule add iif lo sport 51820 to default lookup isp prio 15000
27

ok, so I could also use it for the transmission port?

28

You could, but I don’t think this is a good idea.

29

Why could this be a security issue?

30

It depends what are you trying to download with transmission and why did you install the vpn client in the first place.