When connecting to a server (A) through a WireGuard tunnel via HTTP, the destination server sees the WireGuard server’s (B) public IPv6 address. But when connecting to server A through the tunnel via SSH, the client’s (C) WireGuard tunnel IP is used (and the SSH connection fails, because the firewall only accepts SSH connections from the WireGuard server).
I can fix this by adding a NAT rule to the WireGuard configuration –
PostUp = ip6tables -t nat -A POSTROUTING -s <my-wireguard-subnet> -o eth0 -j MASQUERADE
– or by adding the WireGuard server as a jumphost to the SSH configuration for server A, but I wonder why the address translation seems to happen automatically for HTTP connections.
