On Wed, 13 Jan 2021 20:14:46 +0000 "Posegga, Joachim" <j...@sec.uni-passau.de> wrote:
> Dear all, > > I am trying to connect multiple wireguard clients behind the same NAT-Gateway > to a Mikrotik server with a public IP. I am not yet sure where exactly the > problem is, but it seems that only one client at a time can establish a > tunnel. > > Is this a known problem due to the UDP transport, or should multiple clients > behind a NAT work in principle? > > I understand from the documentation that the server looks at the public key > of the incoming packet and identifies the client. The response sent back from > the server then arrives at the NAT gateway, and it should map the target port > to the correct client and forward it. However, I am not very familiar with > UDP over NAT, so I am wondering if this usually works without problems. If > this is the case, I would know that the problem is most likely on the side of > the Mikrotik server. The NAT router will rewrite outgoing UDP port of your clients' packets when they try to connect to other peers; for two clients on the LAN-side trying to send from the same port, it should change that to two separate UDP ports. Therefore remote peers will see your two clients as being on the same global IP, but using two different ports -- and that should work normally. Check with tcpdump on your NAT's WAN interface what actual UDP packets it sends out. The ports also might be very different from what you specified in WG's config, so account for that in firewalling or routing rules on remote sides. -- With respect, Roman
