PVE Host cannot reach WireGuard peer through LXC container tunnel

[ofgh]

Hello,

I have set up a WireGuard server in a privileged LXC container (CT 109) on my Proxmox host (NUC, 192.168.178.59). The tunnel between the LXC and a remote peer (PBS, pbs01) works perfectly. However, the Proxmox host itself cannot reach the peer through the tunnel.

--- Setup ---

Host "proxmox" (NUC):
- IP: 192.168.178.59
- Proxmox VE 8.x

WireGuard LXC (CT 109, "wg-server"):
- IP: 192.168.178.27
- Privileged Debian 12 container
- WireGuard server: wg0, 10.10.10.1/24, ListenPort 51820
- PostUp/PostDown: iptables FORWARD + NAT MASQUERADE on eth0
- ip_forward = 1

Peer pbs01:
- IP: 192.168.50.131 (different subnet)
- WireGuard client: 10.10.10.2/32, Endpoint 192.168.178.27:51820
- PersistentKeepalive = 25

--- What works ---

- Tunnel between LXC (10.10.10.1) and pbs01 (10.10.10.2): verified, 0% packet loss, active handshake
- ping from LXC to pbs01: OK
- ping from pbs01 to LXC: OK

--- What does NOT work ---

- ping from Proxmox HOST (192.168.178.59) to pbs01 (10.10.10.2): 100% packet loss
- Even after adding: ip route add 10.10.10.0/24 via 192.168.178.27

--- Question ---

How can the Proxmox HOST itself communicate with WireGuard peers through the tunnel running in its own LXC container? Is there a verified, working approach for this specific scenario (host routing through LXC WireGuard tunnel)?

Background: The goal is to add pbs01 as a PBS storage on the Proxmox host so that VMs on the host can be backed up to pbs01 over the WireGuard tunnel.

Thank you!

 

[ofgh]

[SOLVED]

We ended up solving this in a completely different way.

The WireGuard-in-LXC approach has a fundamental architectural limitation: the Proxmox host cannot route traffic through a tunnel running inside its own LXC container, because the tunnel lives in a separate network namespace. Adding static routes on the host (ip route add 10.10.10.0/24 via LXC-IP) does not work for this reason.

Our solution: We switched to Headscale (self-hosted, open-source Tailscale coordination server) with Tailscale clients installed directly on each host.

Setup:
- Headscale server running in a new LXC container (CT 110) on the Proxmox host
- Tailscale client installed directly on the Proxmox host (proxmox, 100.64.0.1)
- Tailscale client installed directly on pbs01 (100.64.0.2)

Result:
- pbs01 is now reachable from the Proxmox host via Tailscale IP (100.64.0.2)
- PBS storage added successfully: pvesm add pbs pbs01-vpn --server 100.64.0.2
- Daily backup jobs running successfully

Key insight: Installing Tailscale directly on the Proxmox host (not in an LXC) avoids the network namespace problem entirely. The host communicates directly with the Tailscale peer without any container routing.

Hope this helps others facing the same issue.