Re: Multiple Clients behind NAT

[Roman Mamedov <rm@romanrm.net>]

On Wed, 13 Jan 2021 20:14:46 +0000
"Posegga, Joachim" <jp@sec.uni-passau.de> wrote:

> Dear all,
> 
> I am trying to connect multiple wireguard clients behind the same NAT-Gateway to a Mikrotik  server with a public IP. I am not yet sure where exactly the problem is, but it seems that only one client at a time can establish a tunnel. 
> 
> Is this a known problem due to the UDP transport, or should multiple clients behind a NAT work in principle? 
> 
> I understand from the documentation that the server looks at the public key of the incoming packet and identifies the client. The response sent back from the server then arrives at the NAT gateway, and it should map the target port to the correct client and forward it. However, I am not very familiar with UDP over NAT, so I am wondering if this usually works without problems. If this is the case, I would know that the problem is most likely on the side of the Mikrotik server.

The NAT router will rewrite outgoing UDP port of your clients' packets when
they try to connect to other peers; for two clients on the LAN-side trying to
send from the same port, it should change that to two separate UDP ports.
Therefore remote peers will see your two clients as being on the same global
IP, but using two different ports -- and that should work normally.

Check with tcpdump on your NAT's WAN interface what actual UDP packets it
sends out. The ports also might be very different from what you specified in
WG's config, so account for that in firewalling or routing rules on remote
sides.

-- 
With respect,
Roman