Skip to main content

Wiregaurd proxmox setup (ip-transit)

🛡️ WireGuard Public IP Tunneling Guide

This guide shows how to tunnel public IP addresses through a WireGuard connection to a virtual machine (VM) on Proxmox. This allows your VM to have a publicly reachable IP even behind NAT or CGNAT.

🖥️ Scenario

  • Proxmox Host behind NAT or firewall.
  • Remote VPS with a public IP (or routed /32 IPs).
  • VM on Proxmox should receive a public IP via WireGuard.

🧱 Network Plan

Role IP Address Interface
VPS 5.231.32.100 eth0, wg1
WireGuard VPS 10.50.0.1/30 wg1
VM 10.50.0.2 wg1 tunnel
VM Public IP 5.231.32.111 via WG tunnel

🔧 VPS Configuration (/etc/wireguard/wg1.conf)

[Interface]
PrivateKey = <server-private-key>
Address = 10.50.0.1/30
ListenPort = 1597

PostUp = sysctl -w net.ipv4.ip_forward=1; iptables -A FORWARD -i %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT
MTU = 1500

[Peer]
PublicKey = <client-public-key>
PresharedKey = <optional-pre-shared-key>
AllowedIPs = 10.50.0.2/30, 5.231.32.111/32, 5.231.32.112/32

🖧 Routing Public IPs via WireGuard

On the VPS, route public IPs to the client via the WG interface:

ip route add 5.231.32.111/32 dev wg1
ip route add 5.231.32.112/32 dev wg1

To persist routes, you can use /etc/network/interfaces, systemd units, or static route config depending on your distro.

🔄 Enable IP Forwarding on VPS

sysctl -w net.ipv4.ip_forward=1
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

🔀 Optional: DNAT/SNAT Instead of Routing

If the public IPs are not routed, use NAT to forward traffic:

# Replace with actual VM WireGuard IP (10.50.0.2)
iptables -t nat -A PREROUTING -d 5.231.32.111 -j DNAT --to-destination 10.50.0.2
iptables -t nat -A POSTROUTING -s 10.50.0.2 -j SNAT --to-source 5.231.32.111

🧷 VM Configuration (Inside the Guest)

Manually assign the public IP to the VM and set the gateway to the WG peer (10.50.0.1):

ip addr add 5.231.32.111/32 dev eth0
ip route add default via 10.50.0.1

Or set this in the VM’s Netplan or /etc/network/interfaces.

🔁 Optional: Proxy ARP (for Routed Mode)

To make the VPS respond to ARP for the public IPs:

echo 1 > /proc/sys/net/ipv4/conf/wg1/proxy_arp
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp

Persist by adding to /etc/sysctl.conf:

net.ipv4.conf.wg1.proxy_arp=1
net.ipv4.conf.eth0.proxy_arp=1

✅ Result

  • Your Proxmox VM will now own and respond to a public IP tunneled through WireGuard.
  • Great for SSH, game servers, web servers, etc.
Back to top