How can I bypass CGNAT by using a VPS with a public IPv4 address?

@[email protected] · 9 months ago

How can I bypass CGNAT by using a VPS with a public IPv4 address?

Admiral Patrick · edit-2 9 months ago

Dumb question: you’re starting wireguard right? lol

In most distros, it’s systemctl start wg-quick@wg0 where wg0 is the name of the config file in /etc/wireguard

If so, then maybe double/triple check any firewalls / iptables rules. My VPS providers don’t have any kind of firewall in front of the VM, but I’m not sure about Hetzner.

Maybe try stopping wireguard, starting a netcat listener on 51820 UDP and seeing if you can send to it from your homelab. This will validate that the UDP port is open and your lab can make the connection.

### VPS
user@vps:  nc -l -u VPS_PUBLIC_IP 51820

### Homelab
user@home:  echo "Testing" | nc -u VPS_PUBLIC_IP 51820

### If successful, VPS should show:
user@vps:  nc -l -u VPS_PUBLIC_IP 51820
Testing

I do know this is possible as I’ve made it work with CG-NAT on both ends (each end was a client and routed through the VPS).

@[email protected] · 9 months ago

The command you provided for the VPS returns UDP listen needs -p arg, so I just added -p right before the port number and then it worked. Running the homelab command returns no port[s] to connect to… Not good.

Admiral Patrick · 9 months ago

At least that points you to the problem: firewall somewhere.

Try a different port with your netcat test, perhaps? 51820 is the well-known WG port. Can’t imagine they’d intentionally block it, but you never know.

Maybe Hetzner support can offer more guidance? Again, I’m not sure what or how they do network traffic before it gets to the VM. On all of mine, it’s just a raw gateway and up to me to handle all port blocking.

If you figure that part out and are still stuck on the WG part, just shoot me a reply.

@[email protected] · 9 months ago

I tried to open the port 22 on UDP (yeah, I am getting pretty desperate over here…) and still get the message no port[s] to connect to… Someone else on this post commented that I should stop using iptables for opening ports and start using something else as a firewall. Should I try this approach?

Admiral Patrick · 9 months ago

Yeah, might be worth a shot. iptables is nice, but very verbose and somewhat obtuse.

I’d just clear out iptables completely and use ufw. Should be in Debian’s package manager.

Here’s a cheat sheet: https://www.digitalocean.com/community/tutorials/ufw-essentials-common-firewall-rules-and-commands

@[email protected] · 9 months ago

What do you mean with “clear out iptables completely”? Should I remove the iptables package with sudo apt remove iptables?

Admiral Patrick · 9 months ago

I believe iptables --flush should clear out any entries you’ve made. You can also reboot and clear them (unless you’ve got scripts bound to your interface up/down config that adds rules).

Basically just need to get any custom iptables rules you made out of there and then re-implement any FW rules with ufw

You can still use iptables alongside UFW, but I only use those for more complex things like port forwarding, masquerading, etc.

@[email protected] · 9 months ago

Alright, I switched to ufw and… it’s still not working. sigh

Should we just try something completely different? WireGuard doesn’t seem to be working on my VPS. Someone in the comments mentioned tunneling via SSH, sounds interesting.

Admiral Patrick · edit-2 9 months ago

That would work, but I’ve noticed performance isn’t as good as a UDP VPN that uses the kernel’s tun module. OpenVPN is also an option, but it’s a LOT more involved to configure (I used to run it before Wireguard existed).

The oddest part is you can’t get a netcat message through. That implies firewall somewhere.

What is the output of your ufw status ?