Dear selfhosted community,
I have recently setup Wireguard (WG) and I am encountering some weird behaviour, which I assume is due to my lack of understanding. I'll describe my current network setup, the devices i'm using in this setup, the issues that I'm facing, and finally my requirements from the WG installation. This might be slightly wrong but I intend to give as much information as possible.
Network setup
I am attempting to use WG from multiple locations. I am using the wg-easy docker image with OOTB settings.
- Location 0 (L0) = My home where WG is hosted (Internal IP
192.168.30.0/24 and ISP A)
- Location 1 (L1) = Using my android phone hotspot (Internal IP
10.19.79.0/24 using ISP B/mobile data plan)
- Location 2 (L2) = My friend's home (Internal IP
192.168.1.0/24 with ISP C)
Devices & Services
For the sake of this example, I have two devices from which I use WG; an Android phone and a Linux laptop.
I have a couple of self-hosted services at L0 which I access using local DNS entries. So if my devices can connect to my DNS server, I can access my local services (https://jellyfin.server.lan/).
All my WG profiles use full-tunneling, i.e., all traffic is sent to my WG server.
Interesting scenarios
Case 1
When I use WG via L1 (both the phone and my laptop), everything works fine. It always reports ISP A which is correct.
Case 2
When I go to L2, the result is mixed. When I connect to WG from my phone, everything works fine.
On my laptop, I can use the internet via WG but I cannot access my local services. I observed that I cannot even ping my devices even though I can use the internet. I verified this by checking ifconfig.io and I could see ISP A.
Case 2B
I tried being a bit creative and manually added a route on my laptop
sudo ip route add 192.168.30.0/24 dev laz-wg
Once I did this, I could ping my devices at L0. But the strange thing is I cannot use my local DNS entries; only direct IP connections were working which indicates my DNS queries were answered by someone else.
Case 3
Another funny observation; if I use my phone at L2 but I use the hotspot facility, i.e., I repeat the signal of my friend's WiFi, and connect my laptop to it AND THEN turn on WG on my laptop, everything works fine (Internet and local DNS entries). I double checked using ifconfig.io and it's reporting ISP A.
Note: I turned off mobile data on my phone before trying the repeater mode, so ISP B is not in the picture in this example.
Case 4 (Repeat of Case 1)
I used another WG profile on my friend's Amazon Firestick (at L2) and I could access my Jellyfin server from it
In summary
- Laptop @ any location + WG + phone hotspot via ISP B = Working
- Laptop @ L2 + WG + phone hotspot via ISP C = Working
- Phone @ L2 + WG via ISP C = Working
- Laptop @ L2 + WG via ISP C = Only internet working, services at L0 not working
So what do I want?
First of all, why this discrepancy between Android and Linux?
I want a WG setup where if I share a WG profile with anyone, I expect
- The user does not have to tinker with the setup
- Local DNS entries should work OOTB
- Should work the same on Windows/Android/Linux
I am prepared to configure everything server side but with minimal change on the client-side. So what is wrong and what should I do to fix it?