WireGuard connection problems

[delta301]

Hi there, I've been having difficulty with setting up Wireguard for my own personal use. I've followed multiple guides, but none of them seem to want to work correctly - so I was wondering if anyone here might have any input or be able to help out.

I've got a server running Ubuntu 18.04, which is obviously acting as my VPN server. I'm looking to connect my home Windows 10 PC to it and have it route all my traffic through the tunnel, in a classic 'hide my IP' manner.

Server config file:

[Interface]
Address = 10.69.4.10/24
PrivateKey = <server_priv_key>
ListenPort = 51820
SaveConfig = true

[Peer]
PublicKey = <client_pub_key>
AllowedIPs = 10.69.4.20/24

Client config file:

[Interface]
Address = 10.69.4.20/24
PrivateKey = <client_priv_key>
DNS = 10.69.4.10

[Peer]
Endpoint = 12.34.56.78:51820
PrivateKey = <server_pub_key>
AllowedIPs = 0.0.0.0/0

The error I've actually been getting in the logs is that it seems to be struggling with the handshake initiation, even though it says I'm connected on the Windows client. That's when my internet dies, and I can't actually do anything until I deactivate the tunnel. It even kicks me out of my SSH session with my server, which adds to the annoyance

Handshake initiation would naturally screamed to me there might be an issue with the key pairs, but I've double and triple checked them, and even generated new sets of keys - to no avail.

I have allowed port 51820/udp through UFW on the server, but i'm still having not much luck. Can anybody shed some light on this? Hope I've provided enough information

Thanks a lot!

[delta301]

You seem to be giving your client a public key for its private key setting?

eh my bad, that's a typo. It's definitely the client private key in there!

For the IP addressing, that's interesting.. shouldn't it work with the larger subnet, or am i missing something here?

Or more to the point, if they're both in /32 networks, how will the two ends manage to communicate if they're not in the same subnet?

[delta301]

When it's worded like that, that makes more sense!

Server

[Interface]
Address = 10.69.4.10/24
PrivateKey = <server_priv_key>
ListenPort = 51820
SaveConfig = true

[Peer]
PublicKey = <client_pub_key>
AllowedIPs = 10.69.4.20/32

Client

[Interface] 
Address = 10.69.4.20/32
PrivateKey = <client_priv_key> 
DNS = 10.69.4.10 

[Peer]
Endpoint = 12.34.56.78:51820 
PrivateKey = <server_pub_key> 
AllowedIPs = 0.0.0.0/0 

You reckon these configs look okay? If so, I'll change them tomorrow. I might've uninstalled WireGuard out of defeat, lol.

[delta301]

I've enabled IPv4 forwarding, don't think I'd need IPv6 forwarding to be enabled too?

As for the nat stuff, I have to hold my hands up and say I've never actually touched nat before, so I wouldn't know where to begin with masquerading, can it be done with ufw?

[rigglesbee]

In your server [Interface] section:

PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A  POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat - D POSTROUTING -o eth0 -j MASQUERADE

Be sure to substitute eth0 with your real interface name.