Network structure

I have the following configurations for WireGuard: 2 Servers (2 linux machines)

S1: 10.221.0.1
S2: 10.222.0.1

2 Devices (1 linux machine, 1 phone)

TEL: 10.221.0.204 - subnet1, 10.222.0.204 - subnet2
PC: 10.221.0.205 - subnet1, 10.222.0.205 - subnet2

Requirements

I want my two devices to be able to access: the subnets of the two servers, the servers themselves, and each other with their respective IPs.

Therefor, the following command should succeed for all devices (and servers):

echo -e "\n\033[1;36mServers:\033[0m" && \
echo -e "\033[1;33mS1 (subnet1):\033[0m" && \
ping -c 1 -W 5 10.221.0.1; \
echo -e "\033[1;33mS2 (subnet2):\033[0m" && \
ping -c 1 -W 5 10.222.0.1; \
echo -e "\n\033[1;36mDevice 1 (PC):\033[0m" && \
echo -e " \033[1;33msubnet1:\033[0m" && \
ping -c 1 -W 5 10.221.0.204; \
echo -e " \033[1;33msubnet2:\033[0m" && \
ping -c 1 -W 5 10.222.0.204; \
echo -e "\n\033[1;36mDevice 2 (TEL):\033[0m" && \
echo -e " \033[1;33msubnet1:\033[0m" && \
ping -c 1 -W 5 10.221.0.205; \
echo -e " \033[1;33msubnet2:\033[0m" && \
ping -c 1 -W 5 10.222.0.205

Problem

For any PC connected to my two servers via WireGuard, everything works fine, they can reach each other, they can reach the servers, and the servers can reach the devices. It's fully functional.

But for my phone (on which I use the WireGuard App, I can only reach the devices of one subnet (like 10.221.0.0/24 for example), for all other subnets, the phone can only reach itself. (The WireGuard app only allows connection to only one tunnel at once, could It be the app is limited in some way which does not allow what I wish?)

Also any services on the phone (eg. 8080) cannot be accessed by either servers or devices, which I wouldn't mind if I were able to at least access my servers from the phone.

IPv4

Ping script

The output of the "script" above on each device is as follows:

TEL:


Servers:
S1 (subnet1): 
PING 10.221.0.1 (10.221.0.1) 56(84) bytes of data. 64 bytes from 10.221.0.1: icmp_seq=1 ttl=64 time=56.4 ms

--- 10.221.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 56.440/56.440/56.440/0.000 ms
S2 (subnet2):
PING 10.222.0.1 (10.222.0.1) 56(84) bytes of data.

--- 10.222.0.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms


Device 1 (TEL):
 subnet1:
PING 10.221.0.204 (10.221.0.204) 56(84) bytes of data.
64 bytes from 10.221.0.204: icmp_seq=1 ttl=64 time=0.118 ms

--- 10.221.0.204 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.118/0.118/0.118/0.000 ms
 subnet2:
PING 10.222.0.204 (10.222.0.204) 56(84) bytes of data.
64 bytes from 10.222.0.204: icmp_seq=1 ttl=64 time=0.106 ms

--- 10.222.0.204 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.106/0.106/0.106/0.000 ms

Device 2 (PC):
 subnet1:
PING 10.221.0.205 (10.221.0.205) 56(84) bytes of data.
64 bytes from 10.221.0.205: icmp_seq=1 ttl=63 time=76.8 ms

--- 10.221.0.205 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 76.896/76.896/76.896/0.000 ms
 subnet2:
PING 10.222.0.205 (10.222.0.205) 56(84) bytes of data.

--- 10.222.0.205 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

As seen, it can access subnet 1 (10.221.0.0/24), but in subnet 2 (10.222.0.0/24) it cannot access anything (other than itself).

PC

Servers:
S1 (subnet1):
PING 10.221.0.1 (10.221.0.1) 56(84) bytes of data.
64 bytes from 10.221.0.1: icmp_seq=1 ttl=64 time=28.6 ms

--- 10.221.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 28.564/28.564/28.564/0.000 ms
S2 (subnet2):
PING 10.222.0.1 (10.222.0.1) 56(84) bytes of data.
64 bytes from 10.222.0.1: icmp_seq=1 ttl=64 time=1.22 ms

--- 10.222.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.220/1.220/1.220/0.000 ms

Device 1 (TEL):
 subnet1:
PING 10.221.0.204 (10.221.0.204) 56(84) bytes of data.
64 bytes from 10.221.0.204: icmp_seq=1 ttl=63 time=147 ms

--- 10.221.0.204 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 146.803/146.803/146.803/0.000 ms
 subnet2:
PING 10.222.0.204 (10.222.0.204) 56(84) bytes of data.
64 bytes from 10.222.0.204: icmp_seq=1 ttl=63 time=5.55 ms

--- 10.222.0.204 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 5.549/5.549/5.549/0.000 ms

Device 2 (PC):
 subnet1:
PING 10.221.0.205 (10.221.0.205) 56(84) bytes of data.
64 bytes from 10.221.0.205: icmp_seq=1 ttl=64 time=0.013 ms

--- 10.221.0.205 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.013/0.013/0.013/0.000 ms
 subnet2:
PING 10.222.0.205 (10.222.0.205) 56(84) bytes of data.
64 bytes from 10.222.0.205: icmp_seq=1 ttl=64 time=0.012 ms

--- 10.222.0.205 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.012/0.012/0.012/0.000 ms

Servers

As for the servers, they can access any device (in their subnet only), I've ommited including the script result due to this reason.

Server configurations

Server 1

[Interface]
SaveConfig = false
ListenPort = 51820
PrivateKey = XXXXXX

# Address (modify)
Address = 10.221.0.1/24, fd42:221::1/64

# Tables (modify)
PostUp = iptables -t nat -I POSTROUTING -s 10.221.0.0/24 -o enp0s25 -j MASQUERADE
PostUp = ip6tables -t nat -I POSTROUTING -s fd42:221::/64 -o enp0s25 -j MASQUERADE
PreDown = iptables -t nat -D POSTROUTING -s 10.221.0.0/24 -o enp0s25 -j MASQUERADE
PreDown = ip6tables -t nat -D POSTROUTING -s fd42:221::/64 -o enp0s25 -j MASQUERADE

# Routes
PostUp = ufw route allow in on wg0 out on enp0s25
PreDown = ufw route delete allow in on wg0 out on enp0s25

# Allow inter-device comm
PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
PreDown = iptables -D FORWARD -i wg0 -o wg0 -j ACCEPT

# DEVICES
# PHONE
[Peer]
PublicKey = EPYLgYUIadJuZbNmehVjIu/XXXXXX
AllowedIPs = 10.221.0.204/32, fd42:221::204/128

# PC
[Peer]
PublicKey = gfH2HHZ07pjas0UlQVM9N1eXXXXXX
AllowedIPs = 10.221.0.205/32, fd42:221::205/128

Server 2:

[Interface]
SaveConfig = false
ListenPort = 51820
PrivateKey = XXXXXX

# Address (modify)
Address = 10.222.0.1/24, fd42:222::1/64

# Tables (modify)
PostUp = iptables -t nat -I POSTROUTING -s 10.222.0.0/24 -o enp2s0 -j MASQUERADE
PostUp = ip6tables -t nat -I POSTROUTING -s fd42:222::/64 -o enp2s0 -j MASQUERADE
PreDown = iptables -t nat -D POSTROUTING -s 10.222.0.0/24 -o enp2s0 -j MASQUERADE
PreDown = ip6tables -t nat -D POSTROUTING -s fd42:222::/64 -o enp2s0 -j MASQUERADE

# Routes
PostUp = ufw route allow in on wg0 out on enp2s0
PreDown = ufw route delete allow in on wg0 out on enp2s0

# Allow inter-device comm
PostUp = iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT
PreDown = iptables -D FORWARD -i wg0 -o wg0 -j ACCEPT


# DEVICES
# PHONE
[Peer]
PublicKey = EPYLgYUIadJuZbNmehVjIu/XXXXXXX
AllowedIPs = 10.222.0.204/32, fd42:222::204/128

# PC
[Peer]
PublicKey = gfH2HHZ07pjas0UlQVM9N1eXXXXXX
AllowedIPs = 10.222.0.205/32, fd42:222::205/128

Device configurations

TEL

PC

[connection]
id=SERVERS ACCESS
type=wireguard
interface-name=wg2

[wireguard]
private-key=XXXXXX

[wireguard-peer.8JZGSGzLGsLuZL08vxlEbK3JzMIKsQWXXXXXX]
endpoint=XXXXXX:51820
persistent-keepalive=25
allowed-ips=10.221.0.0/24;fd42:221::/64;

[wireguard-peer.0oBbgUMu0xR9k6AwwFv4riPXeA4W3qXXXXXX]
endpoint=XXXXXX:51820
persistent-keepalive=25
allowed-ips=10.222.0.0/24;fd42:222::/64;

[ipv4]
address1=10.223.0.205/24
address2=10.222.0.205/24
method=manual

[ipv6]
addr-gen-mode=stable-privacy
address1=fd42:221::205/64
address2=fd42:222::205/64
method=manual

[proxy]

IPv6

Everything works, all devices can reach each other.

Subnets: fd42:221::/64 and fd42:222::/64 Pings, server connections,

Notes

I understand this is a bit of a long read, but I wanted to be thorough. I appreciate any assistance on this matter.

One thing to mention, if I change the Addresses field on the TEL from

10.221.0.204/24, 10.222.0.204/24, fd42:221::204/64, fd42:222::204/64

10.222.0.204/24, 10.221.0.204/24, fd42:221::204/64, fd42:222::204/64

Now pings to 10.221.0.1 will fail while 10.222.0.1 will succeed. This is inexplicable behavior to me

Updates

TCPDump

As suggested by a user, I've ran TCPDump on both servers while I send a ping to see if they reach their destination

Server 1:

TEL> ping 10.221.0.1

❯ sudo tcpdump -ni wg0 'icmp'
[sudo] password for codrut: 
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wg0, link-type RAW (Raw IP), snapshot length 262144 bytes
1...

Recent Questions - Server Fault

Message History

Delivery option(s)