Hello,
I have set up a WireGuard server in a privileged LXC container (CT 109) on my Proxmox host (NUC, 192.168.178.59). The tunnel between the LXC and a remote peer (PBS, pbs01) works perfectly. However, the Proxmox host itself cannot reach the peer through the tunnel.
--- Setup ---
Host "proxmox" (NUC):
- IP: 192.168.178.59
- Proxmox VE 8.x
WireGuard LXC (CT 109, "wg-server"):
- IP: 192.168.178.27
- Privileged Debian 12 container
- WireGuard server: wg0, 10.10.10.1/24, ListenPort 51820
- PostUp/PostDown: iptables FORWARD + NAT MASQUERADE on eth0
- ip_forward = 1
Peer pbs01:
- IP: 192.168.50.131 (different subnet)
- WireGuard client: 10.10.10.2/32, Endpoint 192.168.178.27:51820
- PersistentKeepalive = 25
--- What works ---
- Tunnel between LXC (10.10.10.1) and pbs01 (10.10.10.2): verified, 0% packet loss, active handshake
- ping from LXC to pbs01: OK
- ping from pbs01 to LXC: OK
--- What does NOT work ---
- ping from Proxmox HOST (192.168.178.59) to pbs01 (10.10.10.2): 100% packet loss
- Even after adding: ip route add 10.10.10.0/24 via 192.168.178.27
--- Question ---
How can the Proxmox HOST itself communicate with WireGuard peers through the tunnel running in its own LXC container? Is there a verified, working approach for this specific scenario (host routing through LXC WireGuard tunnel)?
Background: The goal is to add pbs01 as a PBS storage on the Proxmox host so that VMs on the host can be backed up to pbs01 over the WireGuard tunnel.
Thank you!
I have set up a WireGuard server in a privileged LXC container (CT 109) on my Proxmox host (NUC, 192.168.178.59). The tunnel between the LXC and a remote peer (PBS, pbs01) works perfectly. However, the Proxmox host itself cannot reach the peer through the tunnel.
--- Setup ---
Host "proxmox" (NUC):
- IP: 192.168.178.59
- Proxmox VE 8.x
WireGuard LXC (CT 109, "wg-server"):
- IP: 192.168.178.27
- Privileged Debian 12 container
- WireGuard server: wg0, 10.10.10.1/24, ListenPort 51820
- PostUp/PostDown: iptables FORWARD + NAT MASQUERADE on eth0
- ip_forward = 1
Peer pbs01:
- IP: 192.168.50.131 (different subnet)
- WireGuard client: 10.10.10.2/32, Endpoint 192.168.178.27:51820
- PersistentKeepalive = 25
--- What works ---
- Tunnel between LXC (10.10.10.1) and pbs01 (10.10.10.2): verified, 0% packet loss, active handshake
- ping from LXC to pbs01: OK
- ping from pbs01 to LXC: OK
--- What does NOT work ---
- ping from Proxmox HOST (192.168.178.59) to pbs01 (10.10.10.2): 100% packet loss
- Even after adding: ip route add 10.10.10.0/24 via 192.168.178.27
--- Question ---
How can the Proxmox HOST itself communicate with WireGuard peers through the tunnel running in its own LXC container? Is there a verified, working approach for this specific scenario (host routing through LXC WireGuard tunnel)?
Background: The goal is to add pbs01 as a PBS storage on the Proxmox host so that VMs on the host can be backed up to pbs01 over the WireGuard tunnel.
Thank you!