Skip to main content

Wiregaurd proxmox setup (ip-transit)

<del class="diffmod">WireGuard Proxmox Public IP Routing Setup</del>

WireGuard Proxmox Public IP Routing Setup

📦 Step 1: Install WireGuard


apt update && apt install wireguard wireguard-tools -y

📁 Step 2: Create the WireGuard Configconfig

Paste nanothe config that we sent you into /etc/wireguard/wg0.conf

Add inside the [Interface] section:


PostUp = /etc/wireguard/up.sh
PostDown = /etc/wireguard/down.sh

Example:


[Interface]
PrivateKey = YOUR_PRIVATE_KEY
Address = YOUR_WG_IP
PostUp = /etc/wireguard/up.sh
PostDown = /etc/wireguard/down.sh

[Peer]
PublicKey = SERVER_KEY
Endpoint = SERVER_IP:PORT
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25

📜🚀 Step 3: CreateEnable Persistentand Routingstart ScriptWireGuard

systemctl nanoenable /etc/wireguard/up.sh--now wg-quick@wg0

🌐 Step 4: Add routing rules for public IPs

You can run this directly or save as /root/wg-routes.sh:


#!/bin/bash

for ip in {113..117}; do
  ip rule add from 5.231.32.$ip/32 table 11 prio 1
  ip route add 5.231.32.$ip/32 dev vmbr0 table 11
  ip route add 5.231.32.$ip/32 dev vmbr0
done
sleep
1

Make it executable:

chmod +x /root/wg-routes.sh

Then run it:

bash /root/wg-routes.sh

📡 Step 5: Enable IP forwarding and proxy ARP/NDP

You can paste this all at once:

echo 1 > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 1 > /proc/sys/net/ipv6/conf/default/proxy_ndp
sysctlecho -w "net.ipv4.ip_forward=11" sysctl>> -w/etc/sysctl.conf
echo "net.ipv6.conf.all.forwarding=1

📴 Step 4: Create Cleanup Script


nano /etc/wireguard/down.sh


#!/bin/bash

for ip in {113..117}; do
  ip route del 5.231.32.$ip/32 dev vmbr0
  ip route del 5.231.32.$ip/32 dev vmbr0 table 11
  ip rule del from 5.231.32.$ip/32 table 11 prio 1
done


sleep 2


echo 01" > /proc/sys/net/ipv4/conf/all/proxy_arp
echo 0 > /proc/sys/net/ipv6/conf/default/proxy_ndp

🔐 Step 5: Make Scripts Executable


chmod +x /etc/wireguard/up.sh
chmod +x /etc/wireguard/down.sh

🌐 Step 6: Make Forwarding Persistent


nano /etc/sysctl.d/99-wireguard.conf


net.ipv4.ip_forward=1
net.ipv4.conf.all.proxy_arp=1
net.ipv6.conf.all.forwarding=1
net.ipv6.conf.default.proxy_ndp=1

sysctl --systemp

🚀 Step 7: Enable WireGuard On Boot


systemctl enable --now wg-quick@wg0


systemctl status wg-quick@wg0

CheckOr routes:add it into the same script above so it runs after reboot.


ip rule

ip route show table 11

✅ DoneDone!

Your public IPs willshould now survive:route through the WireGuard tunnel.

  • Proxmox reboot
  • WireGuard restart
  • Server restart

VM Settings


IP:
5.231.32.xxx/24

Gateway:
5.231.32.1

LXC Settings


IP:
5.231.32.xxx/32

Gateway:
5.231.32.1
Back to top