Wiregaurd proxmox setup (ip-transit)

---

📦 Step 1: Install WireGuard

apt update &&
apt install wireguard wireguard-tools -y

---

📁 Step 2: Create the WireGuard config

PasteCreate the configtunnel thatconfig:

we

nano sent you into /etc/wireguard/wg0.conf

---

Paste

🚀your WireGuard config.

Inside the [Interface] section add:

PostUp = /etc/wireguard/up.sh PostDown = /etc/wireguard/down.sh

Example:

[Interface] PrivateKey = YOUR_PRIVATE_KEY Address = YOUR_WG_IP PostUp = /etc/wireguard/up.sh PostDown = /etc/wireguard/down.sh

[Peer] PublicKey = SERVER_KEY Endpoint = SERVER_IP:PORT AllowedIPs = 0.0.0.0/0 PersistentKeepalive = 25

Save the file.

📜 Step 3: EnableCreate and start WireGuard

systemctl enable --now wg-quick@wg0

---

🌐 Step 4: Addpersistent routing rules for public IPs

script

You can run this directly or save as /root/wg-routes.sh:Create:

nano /etc/wireguard/up.sh

Paste:

#!/bin/bash
for ip in {113..117}; do
ip rule add from 5.231.32.$ip/32 table 11 prio 1
ip route add 5.231.32.$ip/32 dev vmbr0 table 11
ip route add 5.231.32.$ip/32 dev vmbr0
done

Makesleep it executable:1

chmod +x /root/wg-routes.sh

Then run it:

bash /root/wg-routes.sh

---

📡 Step 5: Enable IP forwarding and proxy ARP/NDP

You can paste this all at once:

echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 1 > /proc/sys/net/ipv6/conf/default/proxy_ndp

echo
sysctl "-w net.ipv4.ip_forward=1"1
>>sysctl /etc/sysctl.conf-w echo "net.ipv6.conf.all.forwarding=1"1

Save.

📴 Step 4: Create cleanup script

Create:

nano /etc/wireguard/down.sh

Paste:

#!/bin/bash

for ip in {113..117}; do
ip route del 5.231.32.$ip/32 dev vmbr0
ip route del 5.231.32.$ip/32 dev vmbr0 table 11
ip rule del from 5.231.32.$ip/32 table 11 prio 1
done

sleep 2

echo 0 > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 0 > /proc/sys/net/ipv6/conf/default.proxy_ndp

Save.

🔐 Step 5: Make scripts executable

chmod +x /etc/wireguard/up.sh
chmod +x /etc/wireguard/down.sh

🌐 Step 6: Make forwarding persistent after reboot

Create:

nano /etc/sysctl.d/99-wireguard.conf
Add:

net.ipv4.ip_forward=1
net.ipv4.conf.all.proxy_arp=1
net.ipv6.conf.all.forwarding=1
net.ipv6.conf.default.proxy_ndp=1

Apply:

sysctl -p

-system

Or🚀 addStep it7: intoEnable theWireGuard sameat script above so it runs after reboot.boot

---

systemctl

enable --now wg-quick@wg0

Check:

systemctl status wg-quick@wg0

Check routing:

ip rule

ip route show table 11

✅ Done!

Done

Your public IPs shouldwill now routekeep throughrouting theafter:

• Proxmox reboot
• WireGuard tunnel.restart
• Server restart

VM settings:

IP: 5.231.32.xxx/24

Gateway: 5.231.32.1

LXC settings:

IP: 5.231.32.xxx/32

Gateway: 5.231.32.1