CGNAT Bypass using Wireguard on Oracle Cloud

README.md

Hello, I had issues with CGNAT and wanted to bypass it using WireGuard and all was fine but I wanted my PC to see the remote address of people connecting to me but I couldnt find anything on the internet here is how I solved it:

1. Add another VNIC to my instance (for seperation, not needed)
2. Add chosen ports in security lists and UFW allow to {interface_ip} port {port}
3. Allow forwarding from wg0 route allow in on wg0 and allow connecting to wg0 allow in on wg0
4. Forward a port:
   • Set up wireguard with keys and peer ips on server and 'client'
   • Paste this PostUp PostDown pair, replace vpn_interface_name with the interface name you want your users to connect to and routing_table_name to name of the table that has this interface as default route:

     PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o {vpn_interface_name} -j MASQUERADE; ip -4 rule add iif wg0 table {routing_table_name}
     PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o {vpn_interface_name} -j MASQUERADE; ip -4 rule delete iif wg0 table {routing_table_name}
     

   • For every port you want to forward add this (change protocol from tcp if needed):

     PostUp = iptables -t nat -A PREROUTING -p tcp -i {vpn_interface_name} --dport {port} -j DNAT --to-destination {peer_ip}
     PostDown = iptables -t nat -D PREROUTING -p tcp -i {vpn_interface_name} --dport {port} -j DNAT --to-destination {peer_ip}
     

   • Now on your device it depends on your OS:
     • Linux:

       Table = off
       PostUp = ip route add default via {server_peer_ip} dev wg0 table wgtable
       PostUp = ip rule add from {client_peer_ip} lookup wgtable
       PostDown = ip rule del from {client_peer_ip} lookup wgtable

     • Windows: Here you have 2 choices: split tunnel with filters or just add a route
       1. Filters: For that I use WireSock, just set up the tunnel with allowedIPs 0.0.0.0/0 and filter your app or whatever to use it
       2. Route:

          Table = off
          PostUp = powershell -command "$wgInterface = Get-NetAdapter -Name wg0; route add 0.0.0.0 mask 0.0.0.0 0.0.0.0 if $wgInterface.ifIndex metric 9999; Set-NetIPInterface -InterfaceIndex$wgInterface.ifIndex -InterfaceMetric 9999;"
          PreDown = powershell -command "$wgInterface = Get-NetAdapter -Name wg0; route delete 0.0.0.0 mask 0.0.0.0 0.0.0.0 if $wgInterface.ifIndex metric 9999; Set-NetIPInterface -InterfaceIndex$wgInterface.ifIndex -InterfaceMetric 9999;"

Then bind your server program to wireguard interface IP and voila! You forwarded a port and get remote peer public IP and not your proxy IP without routing your entire internet through WG