Wireguard VPN setup (4.2 and 4.3)

[solene]

@Mirai

I tried to set this rule in vpn-qube-2:

This looks good but are you sure you need both udp and tcp? This doesn’t matter much for your issue though.

@Mirai

But I though this should not even be necessary and just be tunneled via the normal udp port

It is required because the default rules are to block all incoming traffic on all interfaces, this also applies to “new” interfaces created by VPN and not just eth0 and vifX.Y interfaces managed by Qubes OS.

@Mirai

I want to run a service in vpn-qube-2 that should be reachable by the public VPN address and the port. (Like mullvad port forwarding)

When trying to connect, are you doing it from the remote VPN peer or the public IP address? You need to setup a port redirection on the VPN server to redirect traffic from the public IP address / port to the qube on its VPN IP.

[Mirai]

@solene

This looks good but are you sure you need both udp and tcp? This doesn’t matter much for your issue though.

Are you sure that those rules are enough, just took them from you nat script.

@solene

When trying to connect, are you doing it from the remote VPN peer or the public IP address? You need to setup a port redirection on the VPN server to redirect traffic from the public IP address / port to the qube on its VPN IP.

I don’t have cli access to the remote peer, I am using a VPN provider.

I am trying to access the port from a completely different VPN server

[solene]

@Mirai

I don’t have cli access to the remote peer, I am using a VPN provider.

VPN providers do not offer port forwarding in most cases, and when they do like Proton VPN, they only redirect a single random port using a slightly complicated method.

@Mirai

Are you sure that those rules are enough, just took them from you nat script.

Yes, you just need to open the port locally.

Could you share a bit more information, in private if needed?