[GH-ISSUE #2461] Wireguard: Remove duplicated iptables POSTROUTING masquerade #514

New issue

Closed

opened 2026-02-26 12:45:44 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 12:45:44 +03:00

Owner

Originally created by @Tunebox1 on GitHub (Feb 17, 2025).
Original GitHub issue: https://github.com/community-scripts/ProxmoxVE/issues/2461

Originally assigned to: @tremor021 on GitHub.

🌟 Briefly describe the feature

Masquerade should be only in POSTUP POSTDOWN and duplicated not in POSTROUTING

📝 Detailed description

remove iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE from script
masquerade is already in the wg0.conf postup and postdown, making it duplicated and harder to debug if you dont want to masquerade

💡 Why is this useful?

The Script is setting a masquerade aftert installing wireguard iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE while this is working as intended - for users that do not want to have MASQUERADE, this makes it harder to debug.

This is duplicated, its in the postup postdown and also in the iptables
Making it hard to debug / find the issue if you want to disable MASQUERADE:
If you check the wg0.conf, you can find the MASQUERADE. If you check on the CLI with wg-quick up wg-quick down, you also can find it. So you delete it, thnking you wont doe masuqerade anymore but its still doing it. Only if you now check the iptables as an addition you can find it.

If you install Wireguard manually this is also not set so i think if you decide to set it by default (which i can understand since most users might want that), ONLY put it in the POSTUP and POSTDOWN.

Originally created by @Tunebox1 on GitHub (Feb 17, 2025). Original GitHub issue: https://github.com/community-scripts/ProxmoxVE/issues/2461 Originally assigned to: @tremor021 on GitHub. ### 🌟 Briefly describe the feature Masquerade should be only in POSTUP POSTDOWN and duplicated not in POSTROUTING ### 📝 Detailed description - remove `iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE` from script - masquerade is already in the wg0.conf postup and postdown, making it duplicated and harder to debug if you dont want to masquerade ### 💡 Why is this useful? The Script is setting a masquerade aftert installing wireguard `iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE` while this is working as intended - for users that do not want to have MASQUERADE, this makes it harder to debug. 1. This is duplicated, its in the postup postdown and also in the iptables 2. Making it hard to debug / find the issue if you want to disable MASQUERADE: If you check the wg0.conf, you can find the MASQUERADE. If you check on the CLI with `wg-quick up` `wg-quick down`, you also can find it. So you delete it, thnking you wont doe masuqerade anymore but its still doing it. Only if you now check the iptables as an addition you can find it. If you install Wireguard manually this is also not set so i think if you decide to set it by default (which i can understand since most users might want that), ONLY put it in the POSTUP and POSTDOWN.

kerem

2026-02-26 12:45:44 +03:00

closed this issue
added the
enhancement
label

kerem referenced this issue

2026-02-26 13:34:48 +03:00

[PR #2574] [MERGED] New Script: wger #3831

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/ProxmoxVE#514

No description provided.

Rows
Columns