VPS as Wireguard bridge for site - site behind NAT, dynamic IP
This was surprisingly easy to get going.
Topology - pfSense running on proxmox at a remote site behind ISP router and with a dynamic IP (so double NAT). Proxmox box also runs a container with piHole and a small debian VM.
I need to remotely administer the whole thing. Initially I set up DuckDNS to get the remote IP and an openVPN server on pfSense, but thought there might be an easier solution. There is.
I have a mrVM VPS (thanks @mikho) running Wireguard as installed using @Nyr 's installer https://talk.lowendspirit.com/discussion/974/wireguard-automated-installer-ubuntu-debian-centos-fedora Thanks @Nyr .
The remote subnet is 192.168.1.0/24, my local is 192.168.0.0/24 .
Installed Wireguard on the debian VM running on the remote subnet, and created a .conf file for it on the VPS using @Nyr 's tool. Edited the entry in /etc/wireguard/wg0.conf on the VPS for the new client and changed:
AllowedIPs = 10.7.0.X/32, ipv6 address
to
AllowedIPs = 10.7.0.X/32, 192.168.1.0/24
That does the magic routing of 192.168.1.0/24 over Wireguard to that remote client. I probably could have left the ipv6 entry there as well.
On the remote debian client:
iptables -A FORWARD -i wg0-client -j ACCEPT
iptables -t nat -A POSTROUTING -o ensX -j MASQUERADE
Where wg0-client is the name of the .conf file on the remote debian VM and ensX is its virtual NIC.
Made iptables persistent and started the Wireguard connection as a service:
systemctl start wg-quick@wg0-client
systemctl enable wg-quick@wg0-client
Edit: Oops, and also edit /etc/sysctl.conf on the remote debian VM and add or change:
net.ipv4.ip_forward = 1
then reboot or just do:
sysctl -p
Works like magic - I have full access to the remote 192.168.1.0/24 subnet from my local machine (once that machine is also connected as a Wireguard client of the VPS), without doing anything further.