Skip to main content

Wiregaurd proxmox setup (ip-transit)

🛡🛠️ WireGuard Public IP Tunneling Guide

This guide shows how to tunnel public IP addresses through a WireGuard connection to a virtual machine (VM)Setup on Proxmox.Proxmox This– allowsFull yourGuide VM(Copy to& have a publicly reachable IP even behind NAT or CGNAT.

Paste)

🖥️📦 ScenarioStep 1: Install WireGuard

    apt 
  • Proxmoxupdate Host&& behindapt NATinstall orwireguard firewall.
    • -y

  • Remote VPS with a public IP (or routed /32 IPs).
    • 

  • VM on Proxmox should receive a public IP via WireGuard.
    •

🧱📁 NetworkStep Plan2: Create the WireGuard config

Paste

thisinto
RoleIP AddressInterface
VPS5.231.32.100eth0, wg1
WireGuard VPS10.50.0.1/30wg1
VM10.50.0.2wg1 tunnel
VM Public IP5.231.32.111via WG tunnel

🔧 VPS Configuration (/etc/wireguard/wg1.wg0.conf)

:

[Interface]
PrivateKey = <server-private-key>2J/19N8A3dEPqQazfox8bF6fhnHMCCyIm66DJTG00nQ=
Address = 10.50.0.1/99.87.2/30
ListenPortTable = 1597

PostUp = sysctl -w net.ipv4.ip_forward=1; iptables -A FORWARD -i %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT11
MTU = 1500

[Peer]
PublicKey = <client-public-key>OB6OtLGaaYEF6UT8TA1zP2akiRk+lpaYH+wq5AKOMys=
PresharedKey = <optional-pre-shared-key>VmxEIpk6xrWsqHBkyOvrNkd9xHrMT+txYk511Ytrp8c=
Endpoint = 5.231.32.3:51110
PersistentKeepalive = 25
AllowedIPs = 10.50.0.2/30,0.0.0/0
5.231.32.111/32,
5.231.32.112/32

Save and exit.

🚀 Step 3: Enable and start WireGuard

systemctl enable --now wg-quick@wg0

🖧🌐 RoutingStep Public4: IPsAdd viarouting WireGuard

rules

On the VPS, routefor public IPs to

You thecan clientrun viathis thedirectly WGor interface:save as /root/wg-routes.sh:

#!/bin/bash

for ip routein {113..117}; do
  ip rule add from 5.231.32.111/$ip/32 devtable wg111 prio 1
  ip route add 5.231.32.112/$ip/32 dev wg1vmbr0 table 11
  ip route add 5.231.32.$ip/32 dev vmbr0
done

ToMake persistit routes,executable:

you
chmod can+x use/root/wg-routes.sh

Then run it:

bash /etc/network/interfacesroot/wg-routes.sh
, systemd units, or static route config depending on your distro.

🔄📡 Step 5: Enable IP Forwardingforwarding onand VPSproxy ARP/NDP

You can paste this all at once:

sysctlecho -w1 net.ipv4.ip_forward=> /proc/sys/net/ipv4/conf/all/proxy_arp
echo 1 > /proc/sys/net/ipv6/conf/default/proxy_ndp
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
echo
"net.ipv6.conf.all.forwarding=1"

🔀>> Optional:/etc/sysctl.conf DNAT/SNAT Instead of Routing

If the public IPs are not routed, use NAT to forward traffic:

# Replace with actual VM WireGuard IP (10.50.0.2)
iptablessysctl -t nat -A PREROUTING -d 5.231.32.111 -j DNAT --to-destination 10.50.0.2
iptables -t nat -A POSTROUTING -s 10.50.0.2 -j SNAT --to-source 5.231.32.111

🧷 VM Configuration (Inside the Guest)

Manually assign the public IP to the VM and set the gateway to the WG peer (10.50.0.1):

ip addr add 5.231.32.111/32 dev eth0
ip route add default via 10.50.0.1p

Or setadd thisit ininto the VM’ssame Netplanscript orabove /etc/network/interfaces.so it runs after reboot.

🔁 Optional: Proxy ARP (for Routed Mode)

To make the VPS respond to ARP for the public IPs:

echo 1 > /proc/sys/net/ipv4/conf/wg1/proxy_arp
echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp

Persist by adding to /etc/sysctl.conf:

net.ipv4.conf.wg1.proxy_arp=1
net.ipv4.conf.eth0.proxy_arp=1

✅ ResultDone!

  • Your Proxmoxpublic VMIPs willshould now own and respond to a public IP tunneledroute through WireGuard.

    • the
  • GreatWireGuard fortunnel.

    SSH, game servers, web servers, etc.
Back to top