PiVPN with Wireguard and PiHole not working correctly

[nilsacht]

So here are my files. First befor vpn connection:

ip -4 addr

http://sprunge.us/6tn5bH

ip -4 ro li table all

http://sprunge.us/QA1EPD

ip -4 ru

http://sprunge.us/fZoLwb

iptables-save -c

http://sprunge.us/d8TiGK

ss -tulnp

http://sprunge.us/AUVUD1

---

And with vpn connection:

ip -4 addr

http://sprunge.us/o06sJ4

ip -4 ro li table all

http://sprunge.us/bXoqIg

ip -4 ru

http://sprunge.us/4TE6AI

iptables-save -c

http://sprunge.us/8lwXN1

ss -tulnp

http://sprunge.us/yhU2zi

---

Hope that helps.

[trendy]

There are some docker entries in the iptables.
Check what Joulinar wrote here
Other than that there are no differences in routing/rules/iptables/sockets.

[nilsacht]

There is no path called

/etc/docker/

on my system. I uninstalled docker with dietpi-software. How can I delete the entries?

[trendy]

Try to reboot. That will start fresh without any leftovers from uninstalled software.

[Joulinar]

yes docker is a bad guy if you are running it on a VPN server, I was running into that trap as well personally. It’s easy to fix but hard to find.

That’s basically the issue :FORWARD DROP [4972:303171]

But a reboot should fix it and remove leftover from Docker

[nilsacht]

So reboot does not help. How do I get ridd of :FORWARD DROP [4972:303171]?

[Joulinar]

can you share iptables -S

[nilsacht]

sure

http://sprunge.us/uXY1oS

[Joulinar]

it still contains all the docker rules. strange. can you share dpkg -l docker*

[nilsacht]

sure again

http://sprunge.us/HMiirY

[Joulinar]

just a side node, docker-compose is is still installed, wich doesn’t make sense without docker

do you have any think like iptables-persistent installed loading old data? Check dpkg -l iptable*

BTW: workaround would be iptables -I DOCKER-USER -i eth0 -o wg0 -j ACCEPT. Right after it should be working

[nilsacht]

seems like I have iptables-persistent installed.

http://sprunge.us/SYu1ww

Do I need this?

I tried your command but still no connection to other Pis in my network. Even after a reboot.

[Joulinar]

the workaround is temp. and not persistent at this moment. Means if you reboot, it’s gone. But our goal is to remove docker rules at all

Anyway, if you don’t need to load specific iptables data, it simply can be removed apt remove --purge iptables-persistent

[Sibbefufzich]

If your problem is with IPv6 only, then these commands will not give any useful output.
Better start a new thread and we can discuss it there.
I have updated the commands with sudo (in case you run them as dietpi user) and changed the obsolete netstat with ss (old habits die hard).

Thanks, I started a new thread here: Wireguard with IPv6 not working as expected
nilsacht I hope you can fix your problem. I doubt I can be of much help from here on, compared to trendy and Joulinar.

[nilsacht]

Sibbefufzich Thanks.

@rest
This is my iptable now after uninstall of persistent
http://sprunge.us/pz1EwX

Still doesn’t work

[Joulinar]

ok at least docker is gone now and -P FORWARD ACCEPT was correctly set.

Just some question

• You are sure your clients connecting correctly to the wireguard server from external/internet?
• You see an actual handshake using wg?
• you are able to ping from extern/vpn to your wireguard server?
• ping something else on the local network is failing from extern/vpn?
• sysctl net.ipv4.ip_forward is still set to 1?

[nilsacht]

I check this tomorrow.

[trendy]

• ping something else on the local network is failing from extern/vpn?

For this, a SNAT should be applied, otherwise the other lan hosts will send the packets meant for wireguard to the internet gateway, which will discard the. Or the internet router must have a static route for the wireguard network via the dietpi, and it should not drop invalid packets.

[nilsacht]

Good Morning (in Germany),

Handshake should be ok http://sprunge.us/t7AvRs

Ping to my wireguard server is successfull over vpn. And net.ipv4.ip_forward is still set to 1.

The Ping to other devices in my home network failed (as trendy mentioned)

[Joulinar]

• ping something else on the local network is failing from extern/vpn?

For this, a SNAT should be applied, otherwise the other lan hosts will send the packets meant for wireguard to the internet gateway, which will discard the. Or the internet router must have a static route for the wireguard network via the dietpi, and it should not drop invalid packets.

that might be the different between PiVPN version and DietPi implementation of WireGuard. I did a test installation of the DietPi Wireguard implementation (not PiVPN) and I was able to reach every LAN device without setup anything in addition. It was working right out of the box. I explicitly used a network range not used before

root@DietPi3:~# cat /etc/wireguard/wg0.conf
[Interface]
Address = 10.6.0.1/24

maybe because of the iptable settings done on /etc/wireguard/wg0.conf. They are DietPi specific and I guess missing or different on PiVPN

PreUp = /boot/dietpi/func/obtain_network_details
PostUp = sysctl net.ipv4.conf.%i.forwarding=1 net.ipv4.conf.$(mawk 'NR==3' /run/dietpi/.network).forwarding=1
PostUp = sysctl net.ipv6.conf.$(mawk 'NR==3' /run/dietpi/.network).accept_ra=2
PostUp = sysctl net.ipv6.conf.%i.forwarding=1 net.ipv6.conf.$(mawk 'NR==3' /run/dietpi/.network).forwarding=1
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o $(mawk 'NR==3' /run/dietpi/.network) -j MASQUERADE
PostUp = ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o $(mawk 'NR==3' /run/dietpi/.network) -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o $(mawk 'NR==3' /run/dietpi/.network) -j MASQUERADE
PostDown = ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o $(mawk 'NR==3' /run/dietpi/.network) -j MASQUERADE