Jump to content
  • 0
fl4co

Disable NAT on WireGuard interface

Question

Hello,

I recently bought a Keenetic Skipper router and I’m very pleased with it.

However, there is one problem I can’t seem to be able to fix: I set up a WireGuard connection but I can’t disable NAT translation on the interface. When I connect to a WireGuard peer from a device behind the Skipper, the peer always sees the connection originating from the the Skipper’s WireGuard address and not from the actual device’s IP address.

I tried entering the command “no ip nat Wireguard0” but it has no effect because I think that a NAT rule was not active on the interface to begin with.

So how can I disable NAT on the WireGuard interface?

Share this post


Link to post
Share on other sites

4 answers to this question

Recommended Posts

  • 0

It may not be quite obvious, but NAT is defined by the source interface:

ip nat Home

That means all packets originating from the Home network are transmitted with a subtituted source address.

You change it like this:

no ip nat Home

ip static Home ISP

The second command enables NAT back on the ISP interface. It can be entered more than once if there are multiple such interfaces.

P.S.

Don't forget to save settings:

system configuration save

 

Share this post


Link to post
Share on other sites
  • 0
1 hour ago, ndm said:

It may not be quite obvious, but NAT is defined by the source interface:


ip nat Home

That means all packets originating from the Home network are transmitted with a subtituted source address.

You change it like this:


no ip nat Home

ip static Home ISP

The second command enables NAT back on the ISP interface. It can be entered more than once if there are multiple such interfaces.

P.S.

Don't forget to save settings:


system configuration save

 

Thank you for clearing this out. Now the the wg interface doesn't do NAT anymore as I intended.

What does doing 

no ip nat Home

imply, anyway?

If I create a L2TP VPN then I will have to manually add

ip static Home <l2tp interface>

to be able to access the Internet through the tunnel?

Share this post


Link to post
Share on other sites
  • 0
2 hours ago, fl4co said:

What does doing 


no ip nat Home

imply, anyway?

"Disable NATting all traffic from Home"

2 hours ago, fl4co said:

If I create a L2TP VPN then I will have to manually add


ip static Home <l2tp interface>

to be able to access the Internet through the tunnel?

Right. This way, you can enable NAT for certain in-out interfaces.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Answer this question...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...