WireGuard for remote RDP/Port Forwarding

Client Config

[Interface]
PrivateKey = 
Address = 192.168.0.2/24

[Peer]
PublicKey = 
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1
Endpoint = 10.0.17.111:51820
PersistentKeepalive = 21

Notes: The Routing Lines in this file, are configured to route RDP traffic on 3389 to the MGMT system at 172.16.200.11. Also change the port used if not default

Server Config

[Interface]
PrivateKey = 
Address = 192.168.0.1/24
ListenPort = 51820
PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t nat -A PREROUTING -p tcp -d 192.168.0.1 --dport 3389 -j DNAT --to-destination 172.16.200.11:3389
PreUp = iptables -t nat -A POSTROUTING -o ens160 -j MASQUERADE
PostDown = iptables -t nat -D POSTROUTING -o ens160 -j MASQUERADE
PostDown = iptables -t nat -D PREROUTING -p tcp -d 192.168.0.1 --dport 3389 -j DNAT --to-destination 172.16.200.11:3389

[Peer]
PublicKey = 
AllowedIPs = 192.168.0.2/32
PersistentKeepalive = 21

Notes: Change the Public address, and the port used here, in the [Peer] section

---

Command List for installation:

apt install wireguard
cd /etc/wireguard

#Generate server keys, and change permissions for extra security
wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key
sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key

#Generate client keys
wg genkey | sudo tee /etc/wireguard/clientprivate.key
sudo cat /etc/wireguard/clientprivate.key | wg pubkey | sudo tee /etc/wireguard/clientpublic.key

#Restart, Enable, and check the status of the wg0 interface, with systemctl
systemctl enable wg-quick@wg0.service
systemctl restart wg-quick@wg0.service
systemctl status wg-quick@wg0.service

---

The Client Public key, is to be used in the [Peer] section of the server configuration

The Client Private key is in the [Interface] section of the client configuration

The Server Public key, is to be used in the [Peer] section of the Client configuration

The Server Private Key is to be used in the [Interface] section of the Server Configuration

Site to site with port forwarding

One of the good features of Wireguard is it is a P2P protocol so there are only a few tweaks necessary to allow port forwarding which can be used to have services forwarded from a VPS, thus bypassing the inability to port forward, lack of a static public ipv4 address, or if you are behind CGNAT