Can't access containers remotely
from WeAreAllOne@lemm.ee to selfhosted@lemmy.world on 05 Dec 13:21
https://lemm.ee/post/49067507

Hey everyone. So I created a wire guard tunnel to my home network in order to access my are containers but all I can access is my router login page and one of my access point login page. All being in the same range is 192.168.3.1(router), 192.168.3.2 (access point and switch) and 192.168.3.10 server. My arr listen to their respective ports ie 8989 for sonarr etc. When I’m at home I reach them with no issues. What could be the reason I can’t access them remotely?

#selfhosted

threaded - newest

exu@feditown.com on 05 Dec 13:33 next collapse

Can you ping the server through your tunnel? Maybe try a traceroute to see if it gets through your router correctly.

If this does work, check if the arrs have some “restrict to local network” setting.

If not, I’d check the firewall logs on your router to see if it is blocking the connection.

just_another_person@lemmy.world on 05 Dec 14:09 next collapse

Wireguard only gets you to the endpoint. You need extra routes from there.

Post your wg config, and possibly the staticnroute table on the router. What kind of OS the router is using might help as well to understand possible firewall rules being a problem.

Solution may be as simple as adding a static route to the Wireguard subnet so your other hosts can find it.

colonelp4nic@lemmy.world on 05 Dec 14:43 next collapse

To add, here’s an example of my OpenVPN config addition to ensure 192.168.3.* is accessible over VPN

verb 5
push "route 192.168.3.0 255.255.255.0 vpn_gateway"
just_another_person@lemmy.world on 05 Dec 15:14 collapse

OpenVPN does routing a tad differently, but same point applies. Network clients need to know where to go to find a route that isn’t part of the home subnet they are joined too. With containers in the mix without bridging, the host needs to know that the WG subnet can be found at the router.

WeAreAllOne@lemm.ee on 05 Dec 15:47 collapse

Ah makes sense. I’m using a Mikrotik router and implemented the Back to Home function which automatically creates the tunnel and all firewall configs. Supposedly it’s like me being in my home network but I need to look into your suggestions.

just_another_person@lemmy.world on 05 Dec 16:01 collapse

That may look fine from your router’s perspective, but if your network clients don’t get an updated routing tables, they won’t know or possibly accept traffic from the new subnet on the VPN.

WeAreAllOne@lemm.ee on 05 Dec 19:35 collapse

Solved. All I needed to do was route the Back to Home (wire guard ) address list to a table for the server. 🤙

BCsven@lemmy.ca on 06 Dec 05:35 next collapse

You can set up one device to do masquerading and forwarding then you can see entire lan

Hiro8811@lemmy.world on 08 Dec 09:42 collapse

I’m not familiar with wireguard but I use Tailscale and it works really well