Pihole + Unbound + PiVPN (Wireguard) + tunneling via Ipv6 -> internet OK but can't access local devices (except Dietpi)

Troubleshooting
1

Creating a bug report/issue

Required Information

  • DietPi version | cat /boot/dietpi/.version

G_DIETPI_VERSION_CORE=8
G_DIETPI_VERSION_SUB=8
G_DIETPI_VERSION_RC=1
G_GITBRANCH=‘master’
G_GITOWNER=‘MichaIng’

  • Distro version | echo $G_DISTRO_NAME $G_RASPBIAN

bullseye 0

  • Kernel version | uname -a

Linux DietPi 5.15.61-v7+ #1579 SMP Fri Aug 26 11:10:59 BST 2022 armv7l GNU/Linux

  • SBC model | echo $G_HW_MODEL_NAME or (EG: RPi3)

RPi 2 Model B (armv7l)

  • Power supply used | (EG: 5V 1A RAVpower)

Samsung 5v 1.2a travel adapter

  • SD card used | (EG: SanDisk ultra)

Toshoba Exceria 64Gb

Additional Information (if applicable)

  • Software title

Pihole + Unbound + PiVPN (Wireguard) + tunneling via Ipv6

  • Was the software title installed freshly or updated/migrated?
  • Can this issue be replicated on a fresh installation of DietPi?

This is a fresh installation

Steps to reproduce

Install Pihole + Unbound + PiVPN (Wireguard) + tunneling via Ipv6

Expected behaviour

Access to local network through VPN

Actual behaviour

No access to local network (except DietPi) through VPN

Extra details

  • wg0.conf
[Interface]
PrivateKey = XXX
Address = 10.67.230.1/24,fd11:5ee:bad:c0de::1/64
MTU = 1420
ListenPort = 55016
### begin mi-note-10 ###
[Peer]
PublicKey = XXX
PresharedKey = XXX
AllowedIPs = 10.67.230.2/32,fd11:5ee:bad:c0de::2/128
### end mi-note-10 ###
  • mi-note-10.conf
[Interface]
PrivateKey = EFf4fBCNYMEEOEeR9AEapLnfJE/36RFUT1lk5x6fj2A=
Address = 10.67.230.2/24,fd11:5ee:bad:c0de::2/64
DNS = 10.67.230.1

[Peer]
PublicKey = XXX
PresharedKey = XXX
Endpoint = [DynDNS URL]:55016
AllowedIPs = 0.0.0.0/0, ::0/0
  • iptables rules v4
# Generated by iptables-save v1.8.7 on Wed Aug 31 12:47:36 2022
*nat
:PREROUTING ACCEPT [99:6078]
:INPUT ACCEPT [98:5750]
:OUTPUT ACCEPT [333:21728]
:POSTROUTING ACCEPT [334:22056]
-A POSTROUTING -s 10.168.17.0/24 -o eth0 -m comment --comment wireguard-nat-rule -j MASQUERADE
COMMIT
# Completed on Wed Aug 31 12:47:36 2022
  • iptables rules v6
# Generated by ip6tables-save v1.8.7 on Wed Aug 31 12:47:36 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [160:14166]
:POSTROUTING ACCEPT [47:4205]
-A POSTROUTING -s fd11:5ee:bad:c0de::/64 -o eth0 -m comment --comment wireguard-nat-rule -j MASQUERADE
COMMIT
# Completed on Wed Aug 31 12:47:36 2022
  • PiVPN SetupVars
PLAT=Debian
OSCN=bullseye
USING_UFW=0
IPv4dev=eth0
IPv6dev=eth0
IPv4addr=192.168.1.100/24
IPv4gw=192.168.1.1
install_user=dietpi
install_home=/home/dietpi
VPN=wireguard
pivpnPORT=55016
pivpnDNS1=10.67.230.1
pivpnDNS2=
pivpnHOST=[DynDNS URL]
INPUT_CHAIN_EDITED=0
FORWARD_CHAIN_EDITED=0
INPUT_CHAIN_EDITEDv6=0
FORWARD_CHAIN_EDITEDv6=0
pivpnPROTO=udp
pivpnMTU=1420
pivpnDEV=wg0
pivpnNET=10.67.230.0
subnetClass=24
pivpnenableipv6=1
pivpnNETv6="fd11:5ee:bad:c0de::"
subnetClassv6=64
ALLOWED_IPS="0.0.0.0/0, ::0/0"
INSTALLED_PACKAGES=()

I have tried to edit wg0.conf to add 192.168.1.0/24 to AllowedIP for Peer mi-note-10 → no luck, and the VPN is not functional anymore (handshake forever)

Help would be greatly appreciated :slight_smile:

2

The addresses which you masquerade don’t match the wg interface. In IPv6 it’s correct.

3

Thank you so much, I made the modification, rebooted and voila, it works!
I have spent hours on this and it was so simple :sweat_smile:

I don’t know why the IP was not correct in the ipv4 rules, as this was a fresh install of everything.

1 Like