Rubin Shrestha
Rubin Shrestha
Blog

how to port forward a port from pc through wireguard and a vps to internet (initialising traffic both ways doesn’t work) (behind cgnat)

by |Published

basically this whole setup for now is to port forward port 20818 that qbittorrent is binded to the general internet since I’m behind a firewall (CGNAT)

anyway heres my current setup
in the client:

[Interface]
Address = 10.0.0.2/24
PrivateKey = (redacted)

[Peer]
PublicKey = (redacted)
AllowedIPs = 10.0.0.1/32
EndPoint = (redacted):51820
PersistentKeepalive = 25

and the vps:

[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = (redacted)

[Peer]
PublicKey = (redacted)
AllowedIPs = 10.0.0.2/32

nftables of the vps

flush ruleset
table inet filter {
  chain input {
    type filter hook input priority filter
    policy drop
    ct state invalid drop comment "early drop of invalid connections"
    ct state {established, related} accept comment "allow tracked connections"
    iif lo accept comment "allow from loopback"
    ip protocol icmp accept comment "allow icmp"
    meta l4proto ipv6-icmp accept comment "allow icmp v6"
    tcp dport ssh accept comment "allow sshd"
    iifname "eth0" udp dport 51820 accept comment "allow wireguard"
    pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
    counter
  }
  chain forward {
    type filter hook forward priority filter
    policy accept
  }
}
table inet nat {
    chain prerouting {
        type nat hook prerouting priority -100;
        policy accept
        tcp dport 20818 iif "eth0" dnat ip to 10.0.0.2:20818
        udp dport 20818 iif "eth0" dnat ip to 10.0.0.2:20818
    }
    chain postrouting {
        type nat hook postrouting priority 100;
        policy accept
        oifname "wg0" masquerade
    }
}

basically this allows this
in my laptop I run
nc -lvk 10.0.0.2 20818

than in my phone or whatever
nc vps_public_ip 20818

and guess what it works yay and the route is made and I can send messages back and fourth
and when I run

tcpdump -i wg0 -n port 20818 #in laptop
tcpdump -i eth0 -n port 20818 #in vps

I can see the traffic is going like this

phone_ip:port_A <=> vps_ip:20818 <=> 10.0.0.1:port_A <=> 10.0.0.2:20818

and thats great and all
but will all the peers ips will look to qbittorrent as 10.0.0.1 that would not be ideal what if 2 peers have the same port
but thats a problem for another time
since when in qbittorrent when I told it to use wg0 interface it binds to 20818 in 10.0.0.2 which is correct
but
this is what it tries to do

#the ips are cut since I don't want to expose them lol
❯ sudo tcpdump -i wg0 -n port 20818
18:54:55.340749 IP 10.0.0.2.20818 > 67.2881: UDP, length 115
18:54:55.340775 IP 10.0.0.2.20818 > 87.88.6881: UDP, length 115
18:54:55.340783 IP 10.0.0.2.20818 > 185.7.25401: UDP, length 115
18:54:55.340790 IP 10.0.0.2.20818 > 2126881: UDP, length 115
18:54:59.341163 IP 10.0.0.2.20818 > 67.6881: UDP, length 115
18:54:59.341229 IP 10.0.0.2.20818 > 87.96881: UDP, length 115
18:54:59.341237 IP 10.0.0.2.20818 > 185.247.25401: UDP, length 115
18:54:59.341244 IP 10.0.0.2.20818 > 2181: UDP, length 115
18:54:59.900759 IP 10.0.0.2.20818 > 1840818: UDP, length 104
18:54:59.900785 IP 10.0.0.2.20818 > 1968.20818: UDP, length 104
18:54:59.900795 IP 10.0.0.2.20818 > 1968.20818: UDP, length 104
18:54:59.900803 IP 10.0.0.2.20818 > 190818: UDP, length 104

anyway what I want is simple
I want when qbittorrent tries to do this

10.0.0.2:20818 <=> wow.com:1597

I want wireguard to be like: nah
and does this I guess

10.0.0.2:20818 <=> 10.0.0.1:1597 <=> vps_ip:20818 <=> wow.com:1597

this should be possible since there are vps that offer port forwarding and torrent support that work with qbittorrent

and this is what I tried
this didn’t work

[Interface]
Address = 10.0.0.2/24
PrivateKey = (redacted)
Table = 123
PostUp = ip -4 route change default via 10.0.0.1 table 123
PostUp = ip -4 rule add priority 1 from 10.0.0.2 table 123
PostDown = ip -4 rule del priority 1 from 10.0.0.2 table 123

[Peer]
PublicKey = (redacted)
AllowedIPs = 10.0.0.1/32, 0.0.0.0/0
EndPoint = (redacted):51820
PersistentKeepalive = 25

I don’t think it matter but my vps is debian 13 and I’m using nixos

You may also like