Wireguard handshake works but no internet access

Solution 1:

This is exactly the situation I had. Does your server have a public IP or is it behind a NAT? If it's behind a NAT, the PostUp and PostDown iptables commands from the Linode guide don't apply.

Try adding the following to your server configuration file, changing eth0 to whatever your computer calls it:

PreUp = iptables -t nat -A POSTROUTING -j MASQUERADE -o eth0
PreDown = iptables -t nat -D POSTROUTING -j MASQUERADE -o eth0

Source: https://unix.stackexchange.com/questions/530790/wireguard-not-routing-traffic-from-client-to-other-servers-on-the-network

Example configuration

Here's an example configuration where the router is at 10.0.1.1 (normal network) and 10.0.0.x is the new WireGuard network, with the server being configured for 10.0.0.1 and the client for 10.0.0.2. The port used is 51820 and the default network interface is eth0. All traffic is routed through WireGuard, but it does not stay within the WireGuard subnet. The client has access to the server's local network (10.0.1.x) and the general internet. Don't forget to forward the 51820 port from your router to your server and to enable ipv4 forwarding on the server (# sysctl -w net.ipv4.ip_forward=1)

Server configuration

[Interface]
Address = 10.0.0.1/24
PrivateKey = YOUR_SEVER_PRIVATE_KEY
ListenPort = 51820
PreUp = iptables --table nat --append POSTROUTING --jump MASQUERADE --out-interface eth0
PreDown = iptables --table nat --delete POSTROUTING --jump MASQUERADE --out-interface eth0

[Peer]
PublicKey = YOUR_CLIENT_PUBLIC_KEY
AllowedIPs = 10.0.0.2/32

Client configuration

[Interface]
Address = 10.0.0.2/24
DNS = 10.0.1.1
PrivateKey = YOUR_CLIENT_PRIVATE_KEY
ListenPort = 51820

[Peer]
PublicKey = YOUR_SERVER_PUBLIC_KEY
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = YOUR.DYNAMIC_DNS.COM:51820