[SOLVED] Proxmox, Wireguard and Hetzner's firewall

[Fra]

We spent much time to find the reason why our Wireguard setup in pve (and pbs) was not receiving incoming data. In details we want our proxmox nodes to be able to join a Wireguard VPN, so to be "client" for a dedicated wireguard "server" in a dedicated instance (non proxmox).

It was a general issue related to wireguard and Hetzner's (raw) firewall, nothing to do with proxmox, but we post it here in case somebody face the same issue, doubting his proxmox setup:

The solution is to add a rule that enable UDP incoming traffic on the ephemeral ports 32768-65535 (exactly as you need to do for TCP/ACK)




You can, of course, avoid using Hetzner's firewall, but we find it useful as a second level of protection.

Btw: To install wireguard in proxmox (and in CT) we've followed the perfect https://nixvsevil.com/posts/wireguard-in-proxmox-lxc/


We suspect, anyhow, that the UDP incoming port interval can be more narrow then 32768-65535, any clue?

(to forum admins: if this subject is too dedicated to wireguard, and not to proxmox, and you want to remove it, I understand)

 

[Fra]

We realized it is true we need to allow incoming traffic to the so called ephemeral ports range 32768-65535 (udp) to be able to have a proxmox to be able to be a wireguard peer ("wireguard client"), but of course that traffic can (and should) be limited to the IP of the wireguard "server".

This has nothing to do specifically to proxmox pve or pbs, but just to any server in Hetzner that want to join wireguard and enable Hetzner's stateless firewall

 

[Fra]

In details: the wireguard peer (in this case our proxmox) contact the wireguard "server" at a specific port (51820 by default), but then the connection is established with incoming traffic from the wireguard arriving at a port (with a high number) opened by the peer (exactly as with a web request): in a stateless firewall (the Hetzner firewall in this case) needs to be instructed to allow this (response) traffic https://docs.hetzner.com/robot/dedicated-server/firewall/