📦 Step 1: Install WireGuard

apt update
apt install wireguard wireguard-tools -y

📁 Step 2: Create WireGuard Config

nano /etc/wireguard/wg0.conf

Add inside the [Interface] section:

PostUp = /etc/wireguard/up.sh
PostDown = /etc/wireguard/down.sh

Example:

[Interface]
PrivateKey = YOUR_PRIVATE_KEY
Address = YOUR_WG_IP
PostUp = /etc/wireguard/up.sh
PostDown = /etc/wireguard/down.sh

[Peer]
PublicKey = SERVER_KEY
Endpoint = SERVER_IP:PORT
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

📜 Step 3: Create Persistent Routing Script

nano /etc/wireguard/up.sh

#!/bin/bash

for ip in {113..117}; do
  ip rule add from 5.231.32.$ip/32 table 11 prio 1
  ip route add 5.231.32.$ip/32 dev vmbr0 table 11
  ip route add 5.231.32.$ip/32 dev vmbr0
done


sleep 1


echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 1 > /proc/sys/net/ipv6/conf/default/proxy_ndp

sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv6.conf.all.forwarding=1

📴 Step 4: Create Cleanup Script

nano /etc/wireguard/down.sh

#!/bin/bash

for ip in {113..117}; do
  ip route del 5.231.32.$ip/32 dev vmbr0
  ip route del 5.231.32.$ip/32 dev vmbr0 table 11
  ip rule del from 5.231.32.$ip/32 table 11 prio 1
done


sleep 2


echo 0 > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 0 > /proc/sys/net/ipv6/conf/default/proxy_ndp

🔐 Step 5: Make Scripts Executable

chmod +x /etc/wireguard/up.sh
chmod +x /etc/wireguard/down.sh

🌐 Step 6: Make Forwarding Persistent

nano /etc/sysctl.d/99-wireguard.conf

net.ipv4.ip_forward=1
net.ipv4.conf.all.proxy_arp=1
net.ipv6.conf.all.forwarding=1
net.ipv6.conf.default.proxy_ndp=1

sysctl --system

🚀 Step 7: Enable WireGuard On Boot

systemctl enable --now wg-quick@wg0

systemctl status wg-quick@wg0

Check routes:

ip rule

ip route show table 11

✅ Done

Your public IPs will now survive:

• Proxmox reboot
• WireGuard restart
• Server restart

VM Settings

IP:
5.231.32.xxx/24

Gateway:
5.231.32.1

LXC Settings

IP:
5.231.32.xxx/32

Gateway:
5.231.32.1