mtu 1420
> > inet 10.6.0.1 netmask 255.255.255.0 destination 10.6.0.1
> > inet6 fd42:42:42::1 prefixlen 64 scopeid 0x0
> > unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 1000 (UNSPEC)
> > RX packets 0 bytes 0 (0.0 B)
> > RX errors 0 dropped 0 overruns 0 frame 0
> > TX packets 0 bytes 0 (0.0 B)
> > TX errors 1 dropped 0 overruns 0 carrier 0 collisions 0
---
### Author:  [@rungeard](https://forum.yunohost.org/u/rungeard)
#### Post date: [April 3, 2022, 10:26am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/43 "2022-04-03T10:26:26Z")
> [@julius](#):
>
> But there’s a timeout when I ping 8.8.8.8
Do you ping from YH or VPS ?
Maybe you can also try to restart the VPS and then the YH server. Sometimes it solves the issue from the diagnostic.
> [@julius](#):
>
> transfer: 0 B received, 148 B sent
I have some doubts regarding your iptables rules. It seems YH server don’t receive any packets back.
---
### Author:  [@julius](https://forum.yunohost.org/u/julius)
#### Post date: [April 3, 2022, 11:30am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/44 "2022-04-03T11:30:34Z")
The ping from yunohost is not successful.
After reboot it’s the same problem
What do you mean with the iptables rules? How to check / change them?
> **netstat -tunlp**
>
> yunohost:
>
> > Active Internet connections (only servers)
> > Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
> > tcp 0 0 127.0.0.1:6000 0.0.0.0:\* LISTEN 2361/gitea
> > tcp 0 0 0.0.0.0:80 0.0.0.0:\* LISTEN 2294/nginx: master
> > tcp 0 0 0.0.0.0:9137 0.0.0.0:\* LISTEN 1502/sshd
> > tcp 0 0 127.0.0.1:10001 0.0.0.0:\* LISTEN 1194/postsrsd
> > tcp 0 0 127.0.0.1:10002 0.0.0.0:\* LISTEN 1194/postsrsd
> > tcp 0 0 0.0.0.0:5269 0.0.0.0:\* LISTEN 1992/lua5.1
> > tcp 0 0 0.0.0.0:53 0.0.0.0:\* LISTEN 1547/dnsmasq
> > tcp 0 0 127.0.0.1:5432 0.0.0.0:\* LISTEN 1694/postgres
> > tcp 0 0 0.0.0.0:25 0.0.0.0:\* LISTEN 2406/master
> > tcp 0 0 0.0.0.0:443 0.0.0.0:\* LISTEN 2294/nginx: master
> > tcp 0 0 0.0.0.0:636 0.0.0.0:\* LISTEN 1722/slapd
> > tcp 0 0 0.0.0.0:4190 0.0.0.0:\* LISTEN 1820/dovecot
> > tcp 0 0 0.0.0.0:8095 0.0.0.0:\* LISTEN 1426/node
> > tcp 0 0 127.0.0.1:20000 0.0.0.0:\* LISTEN 2453/sogod
> > tcp 0 0 0.0.0.0:993 0.0.0.0:\* LISTEN 1820/dovecot
> > tcp 0 0 0.0.0.0:20001 0.0.0.0:\* LISTEN 1290/stunnel4
> > tcp 0 0 127.0.0.1:6787 0.0.0.0:\* LISTEN 1378/python3
> > tcp 0 0 127.0.0.1:11332 0.0.0.0:\* LISTEN 1711/rspamd: main p
> > tcp 0 0 127.0.0.1:11333 0.0.0.0:\* LISTEN 1711/rspamd: main p
> > tcp 0 0 127.0.0.1:389 0.0.0.0:\* LISTEN 1722/slapd
> > tcp 0 0 127.0.0.1:11334 0.0.0.0:\* LISTEN 1711/rspamd: main p
> > tcp 0 0 0.0.0.0:5222 0.0.0.0:\* LISTEN 1992/lua5.1
> > tcp 0 0 127.0.0.1:8008 0.0.0.0:\* LISTEN 2636/python
> > tcp 0 0 127.0.0.1:5290 0.0.0.0:\* LISTEN 1992/lua5.1
> > tcp 0 0 0.0.0.0:587 0.0.0.0:\* LISTEN 2406/master
> > tcp 0 0 127.0.0.1:6379 0.0.0.0:\* LISTEN 1515/redis-server 1
> > tcp 0 0 127.0.0.1:11211 0.0.0.0:\* LISTEN 1414/memcached
> > tcp 0 0 0.0.0.0:143 0.0.0.0:\* LISTEN 1820/dovecot
> > tcp6 0 0 :::80 :::\* LISTEN 2294/nginx: master
> > tcp6 0 0 :::9137 :::\* LISTEN 1502/sshd
> > tcp6 0 0 :::5269 :::\* LISTEN 1992/lua5.1
> > tcp6 0 0 :::53 :::\* LISTEN 1547/dnsmasq
> > tcp6 0 0 ::1:5432 :::\* LISTEN 1694/postgres
> > tcp6 0 0 :::25 :::\* LISTEN 2406/master
> > tcp6 0 0 :::443 :::\* LISTEN 2294/nginx: master
> > tcp6 0 0 :::636 :::\* LISTEN 1722/slapd
> > tcp6 0 0 :::4190 :::\* LISTEN 1820/dovecot
> > tcp6 0 0 :::8448 :::\* LISTEN 2636/python
> > tcp6 0 0 :::993 :::\* LISTEN 1820/dovecot
> > tcp6 0 0 ::1:11332 :::\* LISTEN 1711/rspamd: main p
> > tcp6 0 0 ::1:11333 :::\* LISTEN 1711/rspamd: main p
> > tcp6 0 0 ::1:11334 :::\* LISTEN 1711/rspamd: main p
> > tcp6 0 0 :::5222 :::\* LISTEN 1992/lua5.1
> > tcp6 0 0 ::1:8008 :::\* LISTEN 2636/python
> > tcp6 0 0 :::3306 :::\* LISTEN 1698/mysqld
> > tcp6 0 0 ::1:5290 :::\* LISTEN 1992/lua5.1
> > tcp6 0 0 :::587 :::\* LISTEN 2406/master
> > tcp6 0 0 ::1:6379 :::\* LISTEN 1515/redis-server 1
> > tcp6 0 0 :::143 :::\* LISTEN 1820/dovecot
> > udp 0 0 0.0.0.0:31582 0.0.0.0:\* 1547/dnsmasq
> > udp 0 0 10.6.0.2:5353 0.0.0.0:\* 1362/python3
> > udp 0 0 0.0.0.0:5353 0.0.0.0:\* 1362/python3
> > udp 0 0 0.0.0.0:38929 0.0.0.0:\* -
> > udp 0 0 0.0.0.0:53 0.0.0.0:\* 1547/dnsmasq
> > udp 0 0 0.0.0.0:68 0.0.0.0:\* 2048/dhclient
> > udp 0 0 10.6.0.2:123 0.0.0.0:\* 2257/ntpd
> > udp 0 0 192.168.178.34:123 0.0.0.0:\* 2257/ntpd
> > udp 0 0 127.0.0.1:123 0.0.0.0:\* 2257/ntpd
> > udp 0 0 0.0.0.0:123 0.0.0.0:\* 2257/ntpd
> > udp6 0 0 :::38929 :::\* -
> > udp6 0 0 :::53 :::\* 1547/dnsmasq
> > udp6 0 0 :::32889 :::\* 1547/dnsmasq
> > udp6 0 0 2001:a61:24b5:a601::123 :::\* 2257/ntpd
> > udp6 0 0 fd42:42:42::2:123 :::\* 2257/ntpd
> > udp6 0 0 fe80::46a1:8967:4a6:123 :::\* 2257/ntpd
> > udp6 0 0 ::1:123 :::\* 2257/ntpd
> > udp6 0 0 :::123 :::\* 2257/ntpd
>
> vps:
>
> > Active Internet connections (only servers)
> > Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
> > tcp 0 0 0.0.0.0:9988 0.0.0.0:\* LISTEN 762/sshd: /usr/sbin
> > tcp6 0 0 :::9988 :::\* LISTEN 762/sshd: /usr/sbin
> > root@localhost:/home/juser# netstat -tunlp
> > Active Internet connections (only servers)
> > Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
> > tcp 0 0 0.0.0.0:9988 0.0.0.0:\* LISTEN 762/sshd: /usr/sbin
> > tcp6 0 0 :::9988 :::\* LISTEN 762/sshd: /usr/sbin
> > udp 0 0 0.0.0.0:51820 0.0.0.0:\* -
> > udp6 0 0 :::51820 :::\*
> **iptables -L**
>
> yunohost:
>
> > Chain INPUT (policy DROP)
> > target prot opt source destination
> > ACCEPT all – anywhere anywhere state RELATED,ESTABLISHED
> > ACCEPT tcp – anywhere anywhere tcp dpt:ssh
> > ACCEPT tcp – anywhere anywhere tcp dpt:smtp
> > ACCEPT tcp – anywhere anywhere tcp dpt:domain
> > ACCEPT tcp – anywhere anywhere tcp dpt:http
> > ACCEPT tcp – anywhere anywhere tcp dpt:https
> > ACCEPT tcp – anywhere anywhere tcp dpt:submission
> > ACCEPT tcp – anywhere anywhere tcp dpt:imaps
> > ACCEPT tcp – anywhere anywhere tcp dpt:xmpp-client
> > ACCEPT tcp – anywhere anywhere tcp dpt:xmpp-server
> > ACCEPT tcp – anywhere anywhere tcp dpts:49153:49193
> > ACCEPT tcp – anywhere anywhere tcp dpt:8448
> > ACCEPT tcp – anywhere anywhere tcp dpt:5349
> > ACCEPT tcp – anywhere anywhere tcp dpt:5350
> > ACCEPT tcp – anywhere anywhere tcp dpt:9137
> > ACCEPT udp – anywhere anywhere udp dpt:domain
> > ACCEPT udp – anywhere anywhere udp dpt:mdns
> > ACCEPT udp – anywhere anywhere udp dpts:49153:49193
> > ACCEPT udp – anywhere anywhere udp dpt:5349
> > ACCEPT udp – anywhere anywhere udp dpt:5350
> > ACCEPT all – anywhere anywhere
> > ACCEPT icmp – anywhere anywhere
> >
> > Chain FORWARD (policy ACCEPT)
> > target prot opt source destination
> >
> > Chain OUTPUT (policy ACCEPT)
> > target prot opt source destination
>
> vps:
>
> > Chain INPUT (policy ACCEPT)
> > target prot opt source destination
> > ACCEPT icmp – anywhere anywhere
> >
> > Chain FORWARD (policy ACCEPT)
> > target prot opt source destination
> > ACCEPT all – anywhere anywhere
> > ACCEPT tcp – 10.0.6.2 anywhere tcp dpt:smtp
> > ACCEPT tcp – 10.0.6.2 anywhere tcp dpt:submission
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:smtp
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:http
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:140
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:https
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:submission
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:imaps
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:xmpp-client
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:xmpp-server
> > ACCEPT tcp – anywhere 10.6.0.2 tcp dpt:9137
> >
> > Chain OUTPUT (policy ACCEPT)
> > target prot opt source destination
> > This text will be hidden
---
### Author:  [@rungeard](https://forum.yunohost.org/u/rungeard)
#### Post date: [April 3, 2022, 1:06pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/45 "2022-04-03T13:06:59Z")
These rules seem correct. If you want, you can send me in PM your two wg0.conf, PostUp and PostDown and I can check if everything looks good.
Could you also check that you can `ping google.com` and `ping -6 google.com` from VPS ?
---
### Author:  [@macbryan](https://forum.yunohost.org/u/macbryan)
#### Post date: [April 12, 2022, 10:40am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/46 "2022-04-12T10:40:55Z")
Hello,
@rungeard thank you for your work!
Could you tell me from which device the ip 10.0.6.2 is from in your iptables?
---
### Author:  [@rungeard](https://forum.yunohost.org/u/rungeard)
#### Post date: [April 12, 2022, 11:05am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/47 "2022-04-12T11:05:51Z")
> [@macbryan](#):
>
> Could you tell me from which device the ip 10.0.6.2 is from in your iptables?
10.6.0.2 is the ip assign to the YunoHost server (the WireGuard client)
---
### Author:  [@macbryan](https://forum.yunohost.org/u/macbryan)
#### Post date: [April 12, 2022, 11:10am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/48 "2022-04-12T11:10:39Z")
> [@rungeard](#):
>
> ```auto
> do
> iptables -t nat -A POSTROUTING -s 10.6.0.2 -p tcp --dport $j -j SNAT --to [insert public IPV4 of the VPS];
> iptables -A FORWARD -s
>
> 10.0.6.2
>
> -p tcp --dport $j -j ACCEPT;
> ip6tables -t nat -A POSTROUTING -s fd42:42:42::2 -p tcp --dport $j -j SNAT --to [insert public IPV6 of the VPS];
> ip6tables -A FORWARD -s fd42:42:42::2 -p tcp --dport $j -j ACCEPT;
> done
>
> ```
So could it be a little typo here?
---
### Author:  [@macbryan](https://forum.yunohost.org/u/macbryan)
#### Post date: [April 12, 2022, 11:22am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/50 "2022-04-12T11:22:16Z")
In your iptables for routing port 25 and 587
there is the ip corrent
`iptables -t nat -A POSTROUTING -s 10.6.0.2 -p tcp --dport $j -j SNAT --to [insert public IPV4 of the VPS];`
ten.six.zero.two
but one row after it
`iptables -A FORWARD -s 10.0.6.2 -p tcp --dport $j -j ACCEPT;`
ten.zero.six.two
---
### Author:  [@rungeard](https://forum.yunohost.org/u/rungeard)
#### Post date: [April 12, 2022, 11:29am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/51 "2022-04-12T11:29:12Z")
You are right ! I made the changes in the main post.
---
### Author:  [@Nico1](https://forum.yunohost.org/u/Nico1)
#### Post date: [April 26, 2022, 5:38pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/52 "2022-04-26T17:38:01Z")
Bonjour merci pour ce tuto qui le donne envie de passer à l’achat 😁
Question
SI dans le cas d’autres utilisateurs souhaiteraient s’y connecter pour l’utiliser comme simple VPN tout en gardant les règles pour le yunohost quelle tête aurai le postup et postdown ?
Merci
---
### Author:  [@rungeard](https://forum.yunohost.org/u/rungeard)
#### Post date: [April 26, 2022, 5:46pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/53 "2022-04-26T17:46:32Z")
> [@Nico1](#):
>
> SI dans le cas d’autres utilisateurs souhaiteraient s’y connecter pour l’utiliser comme simple VPN tout en gardant les règles pour le yunohost quelle tête aurai le postup et postdown ?
yes it’s possible.
You generate on every client a private and a public key.
On the VPS you add to wg0.cong the line
```auto
### begin new client ###
[Peer]
PublicKey = [insert public key of the new client]
AllowedIPs = 10.6.0.X/32,fd42:42:42::X/128 #with X = 3 then 4, 5, etc
### end new client###
```
On the VPS you add to PostUp
```auto
iptables -t nat -A POSTROUTING -s 10.6.0.X -j SNAT --to [insert public IPV4 of the VPS];
iptables -A FORWARD -s 10.6.0.X -j ACCEPT;
ip6tables -t nat -A POSTROUTING -s fd42:42:42::X -j SNAT --to [insert public IPV6 of the VPS];
ip6tables -A FORWARD -s fd42:42:42::X -j ACCEPT;
```
On the VPS you add to PostDown
```auto
iptables -t nat -D POSTROUTING -s 10.6.0.X -j SNAT --to [insert public IPV4 of the VPS];
iptables -D FORWARD -s 10.6.0.X -j ACCEPT;
ip6tables -t nat -D POSTROUTING -s fd42:42:42::X -j SNAT --to [insert public IPV6 of the VPS];
ip6tables -D FORWARD -s fd42:42:42::X -j ACCEPT;
```
wg0 of the new client
```auto
[Interface]
PrivateKey = [insert private key of the new client]
Address = 10.6.0.X/24, fd42:42:42::X/64
# choose your DNS - for instance FDN DNS resolver
DNS = 80.67.169.12, 2001:910:800::12
[Peer]
PublicKey = [insert public key of the VPS]
Endpoint = [insert your domain name (link to the ips of the VPS server)]:51820
AllowedIPs = 0.0.0.0/0, ::0/0
PersistentKeepalive = 25
```
Don’t forget to replace X with 3 then 4,5,6, etc everywhere
---
### Author:  [@Nico1](https://forum.yunohost.org/u/Nico1)
#### Post date: [April 26, 2022, 6:37pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/54 "2022-04-26T18:37:38Z")
Merci pour 'es infos.
Par contre si l’on suis ce tuto et que l’on rajoute les lignes que m’a donné est-ce que cela va poser un soucis ?
Encore merci.
---
### Author:  [@rungeard](https://forum.yunohost.org/u/rungeard)
#### Post date: [April 26, 2022, 6:50pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/55 "2022-04-26T18:50:09Z")
> [@Nico1](#):
>
> Par contre si l’on suis ce tuto et que l’on rajoute les lignes que m’a donné est-ce que cela va poser un soucis ?
En théorie non après j’ai pas testé personnellement avec plusieurs appareils. Tous retour est le bienvenue !
---
### Author:  [@Nico1](https://forum.yunohost.org/u/Nico1)
#### Post date: [April 26, 2022, 7:02pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/56 "2022-04-26T19:02:07Z")
Enfin j’ai déjà wireguard à la maison en tant que serveur et je fais passer quelque client. Donc j’ai vraiment une configuration de base avec
J’aimerai faire évoluer tout ça en faisant passer plus de chose dans les tuyaux.
Je vais essayer en partant de zéro avec les clients (ce que je sais faire a peu près) et je rajouterai ta config.
🙏
---
### Author:  [@charly](https://forum.yunohost.org/u/charly)
#### Post date: [April 29, 2022, 6:20am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/57 "2022-04-29T06:20:55Z")
Bonjour,
Si tu arrives à connecter le YNH + d’autres client, je suis intéressé par ta config.
MErci 🙂
---
### Author:  [@Nico1](https://forum.yunohost.org/u/Nico1)
#### Post date: [April 29, 2022, 6:54am UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/58 "2022-04-29T06:54:20Z")
Salut.
J’ai commendé le vos hier et déjà bidouillé mais j’ai j’arrive pas à me connecter pour l’instant. Faut que je me pose tranquillement.
😁
---
### Author:  [@Nico1](https://forum.yunohost.org/u/Nico1)
#### Post date: [April 29, 2022, 4:10pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/59 "2022-04-29T16:10:31Z")
C’est bizarre j’ouvre les ports dans l’interface de IONOS et faisant un check ça me dit que c’est fermé :~
---
### Author:  [@rungeard](https://forum.yunohost.org/u/rungeard)
#### Post date: [April 29, 2022, 4:22pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/60 "2022-04-29T16:22:29Z")
> [@Nico1](#):
>
> C’est bizarre j’ouvre les ports dans l’interface de IONOS et faisant un check ça me dit que c’est fermé
de mémoire certains ports dont le 25 nécessite un appel au service client par téléphone pour être ouvert, on ne peut pas le faire directement sur l’interface web.
---
### Author:  [@Nico1](https://forum.yunohost.org/u/Nico1)
#### Post date: [April 29, 2022, 4:25pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/61 "2022-04-29T16:25:49Z")
Rien que celui du VPN est ouvert dans IONOS mais pas quand je check l’extérieur, faut pas non plus ouvrir ailleur?
---
### Author:  [@Nico1](https://forum.yunohost.org/u/Nico1)
#### Post date: [April 29, 2022, 4:27pm UTC](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662/62 "2022-04-29T16:27:20Z")
celui que j’ai a mon domicile avec ubuntu j’avais aussi ouvert avec UFW
[Previous page](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662.md?page=2)
[Next page](https://forum.yunohost.org/t/homemade-wireguard-vpn-on-a-vps-server/15662.md?page=4)