Wireguard and double NAT

Wireguard and double NAT

[Hendrik Friedel]

Hello,

I have a running Server serving several Clients with a wireguard tunnel 
already. For this, port 51820 UDP is porwarded in my router to the 
Server.

Now, I have one Client with a bit of a tricky setup: I have two Routers 
doing NAT. For one of those, I have no control, i.e. I cannot setup 
portforwarding.

Is it still possible, to use Wireguard to create a tunnel between my 
server and this tricky client? If so, is there anything special, that I 
need to consider?

Best regards,
Hendrik

Re: Wireguard and double NAT

[Ashish SHUKLA]

[-- Attachment #1: Type: text/plain, Size: 1168 bytes --]

On Fri, Mar 04, 2022 at 12:03:05PM +0000, Hendrik Friedel wrote:
> Hello,
> 
> I have a running Server serving several Clients with a wireguard tunnel
> already. For this, port 51820 UDP is porwarded in my router to the Server.
> 
> Now, I have one Client with a bit of a tricky setup: I have two Routers
> doing NAT. For one of those, I have no control, i.e. I cannot setup
> portforwarding.
> 
> Is it still possible, to use Wireguard to create a tunnel between my server
> and this tricky client? If so, is there anything special, that I need to
> consider?

IIUC, it's quite possible as long as none of the routers are filtering packets
with following constraints:

 - client has to initiate the connection

To increase the reliability of the connectivity:
 - preferably not use a fixed listen port in the client, esp. if it's roaming,
   or you failover between gateways
 - setup PersistentKeepalive

I have a similar setup with my internet connection (behind double NAT), and
it works fine.

HTH
-- 
Ashish | GPG: F682 CDCC 39DC 0FEA E116  20B6 C746 CFA9 E74F A4B0

"Should I kill myself, or have a cup of coffee?" (Albert Camus)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 963 bytes --]