reading the VPN NAT Gateway part of your documentation I m h

Question

reading the VPN NAT Gateway part of your documentation I m having trouble understanding what s causing trouble on my otherwise fully functional netmaker setup According to this part https netmaker readthedocs io en latest egress gateway html vpn nat gateway ~ text=the 20egress 20gateway 2 20VPN 20 20NAT 20Gateway C2 B6 Most 20people 20think adding the network subset to the Egress Gateway is supposed to make a client properly exit trough the Egress node on the Internet IDK if it s because I m using `wg quick up a netmaker generated ext client conf` on my tests but as soon as I pop the VPN client up I loose any internet connection

glamorous-crowd-4515 · Answer

I made sure that there was no overlapping between my address spaces

glamorous-crowd-4515 · Answer

netmaker 1 is the Egress gateway there is no other client on this network

glamorous-crowd-4515 · Answer

hm I also tried w a normal netclient I added a single route to 8 8 8 8 32 to ensore link availability via ICMP

glamorous-crowd-4515 · Answer

no result

bored-island-21407 · Answer

what did you set the egress gateway range to be

glamorous-crowd-4515 · Answer

first I tried and followed the docs

glamorous-crowd-4515 · Answer

```0 0 0 0 5 8 0 0 0 7 11 0 0 0 8 12 0 0 0 6 16 0 0 0 4 32 0 0 0 3 64 0 0 0 2 128 0 0 0 3 160 0 0 0 5 168 0 0 0 6 172 0 0 0 12 172 32 0 0 11 172 64 0 0 10 172 128 0 0 9 173 0 0 0 8 174 0 0 0 7 176 0 0 0 4 192 0 0 0 9 192 128 0 0 11 192 160 0 0 13 192 169 0 0 16 192 170 0 0 15 192 172 0 0 14 192 176 0 0 12 192 192 0 0 10 193 0 0 0 8 194 0 0 0 7 196 0 0 0 6 200 0 0 0 5 208 0 0 0 4```

glamorous-crowd-4515 · Answer

then seeing that it was triggering an odd behaviour I reducing the range to 8 8 8 8 32 to reproduce my issue w a smaller radius

glamorous-crowd-4515 · Answer

hm I m seeing an odd behaviour

glamorous-crowd-4515 · Answer

< bored island 21407> while this is true with a wireguard client as in an ext client generated w netmaker

glamorous-crowd-4515 · Answer

it doesn t apply if I use netclient and discard the ingress tick on the node that is supposed to mask my external IP

glamorous-crowd-4515 · Answer

so ingress + egress w those routes + wireguard client no bueno egress + netclient

glamorous-crowd-4515 · Answer

I think I found what was missing < bored island 21407> I d like to run it by you to fix this wg quick issue I had to explicitely add my server public ipaddress route `ip r add foo bar baz bam via my lan gateway to the net dev wlan0` i e which was not done by the generated wireguard config

glamorous-crowd-4515 · Answer

maybe it should be a `PreUp` command on the generated config w the endpoint address the device s default gateway

bored-island-21407 · Answer

interesting

glamorous-crowd-4515 · Answer

I haven t compared yet what differs from this while I m successfuly netclient to run the exact same thing using this same server as a gateway to the internet

bored-island-21407 · Answer

this is to get to a specific machine where the netmaker client is acting as an egress gateway for just that machine

glamorous-crowd-4515 · Answer

the use case that I m trying to POC here is a workstation has to mask its public ip address on a single exit node using a wg config i e not using netclient per se

bored-island-21407 · Answer

i still not sure that I completely understand what you were trying to do and whether you were doing it with netmaker or pure wireguard

glamorous-crowd-4515 · Answer

ok sorry about that let me rephrase I have a netmaker instance with two networks for two different purposes The first network runs fine it s a mesh network where all my servers are on the same wg network managed by netmaker So far nothing fancy The second one the one I m trying to debug here is just a single node my netmaker server with a fleet of devices connected to it ext clients and using as a default gateway to reach the internet To mask their identity for instance When I m applying what is suggested in the docs namely the list of ip ranges to set in the egress and connecting my external client to this server I lose Internet connectivity for a good reason my server is on the Internet Unless I explicitely tell wireguard to use an exceptional route namely `ip r add foo bar baz bam via my lan gateway to the net dev wlan0` or `ip r add wg server public ip addr $ ip r get 1 1 1 1|awk F src print $1 |awk F 1 1 1 1 print $2 ` I can t reach the wg endpoint and therefore can t use it as a gateway

bored-island-21407 · Answer

ok let me process that for a bit

glamorous-crowd-4515 · Answer

i can make a drawing if it helps

bored-island-21407 · Answer

so you are using the netmaker server as both an ingress gateway for the ext clients and as an egress gateway to the internet have I got that right

glamorous-crowd-4515 · Answer

yeah indeed

glamorous-crowd-4515 · Answer

it s both in and egress

bored-island-21407 · Answer

and the ip route command is running on server foo bar baz bam is server

glamorous-crowd-4515 · Answer

the ip route command is to be run on the client

bored-island-21407 · Answer

or you have to run that on the ext clients

glamorous-crowd-4515 · Answer

and foo bar baz bam is indeed the server or replaced as wg server public ip addr on the second example

glamorous-crowd-4515 · Answer

on ext clients yep

bored-island-21407 · Answer

ok gottcha understand it now

glamorous-crowd-4515 · Answer

because you override the route used to reach the remote server in the first place with the AllowedIPs

bored-island-21407 · Answer

true that why you can t just use 0 0 0 0 0 in allowedips

glamorous-crowd-4515 · Answer

it s kind of the same reason yep

glamorous-crowd-4515 · Answer

although you can bypass that using an override ip route command explicit for this unique remoteip

glamorous-crowd-4515 · Answer

as far as I understand wg mechanism it should then be a preup command to make sure that there is an exception to all the other rules that the client will have to ingest

bored-island-21407 · Answer

I think you are correct

glamorous-crowd-4515 · Answer

at least my poc tells me that I may be missing smt

bored-island-21407 · Answer

when are you currently running that ip route command before or after bring up the wg interface

glamorous-crowd-4515 · Answer

it works either way since wg is stateless if I haven t the route in my routing table I lose my connection if I have it i can go online

bored-island-21407 · Answer

so then it should be ok to put either in a postup or preup

glamorous-crowd-4515 · Answer

yep

glamorous-crowd-4515 · Answer

wg runtime parsing should not be trivial though since you have to retrieve both gateway and interface name with iproute commands

bored-island-21407 · Answer

But this needs to be run on the ext client How can the server determine the interface name of the ext client

glamorous-crowd-4515 · Answer

the client has to run the pre up script but the server has to generate a pre up script with its endpoint IP

glamorous-crowd-4515 · Answer

in this case it could be done on the ext client config template

glamorous-crowd-4515 · Answer

`ip r add $templated and known public ip address $ ip r get 1 1 1 1|awk F src print $1 |awk F 1 1 1 1 print $2 `

glamorous-crowd-4515 · Answer

idk how preup works but if it is close to bash this should do the trick

bored-island-21407 · Answer

I see Might work

bored-island-21407 · Answer

have you tried adding that as a preup in a wg conf file

glamorous-crowd-4515 · Answer

it is not interpreted as is by wg this is why i wanted to run it by you x

glamorous-crowd-4515 · Answer

```Line unrecognized `PreUp=ipraddtemplated and known public ip address$ iprget1 1 1 1|awk F src print$1 |awk F 1 1 1 1 print$2 ```

glamorous-crowd-4515 · Answer

this is what is returned by the parser

bored-island-21407 · Answer

try adding bash c to front of command eg bash c ip r add x x x x via

glamorous-crowd-4515 · Answer

good idea

glamorous-crowd-4515 · Answer

it works also I had it in the wrong section the good one is ` interface `

glamorous-crowd-4515 · Answer

hm good to know android wireguard client doesnt need this preup

bored-island-21407 · Answer

well android client does funky stuff with allowed ips

glamorous-crowd-4515 · Answer

it is not able to read the line either btw qr scan throws an error x

bored-island-21407 · Answer

fyi you can get default dev with just `ip r get 1 1 1 1 | awk print $5

glamorous-crowd-4515 · Answer

noted

glamorous-crowd-4515 · Answer

should I open an issue for this < bored island 21407>

bored-island-21407 · Answer

yes please

glamorous-crowd-4515 · Answer

https github com gravitl netmaker issues 1175 done

jolly-london-20127 · Answer

Issue configuring VPN NAT Gateway