# Check if traffic hits the pod

```shell
kubectl -n wg-easy exec -it wg-easy-wg-easy-0 -- wg show
```

```shell
microk8s kubectl -n wg-easy exec -it wg-easy-wg-easy-0 -- iptables -t nat -L -n -v | grep 10.8
```

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens192 -j MASQUERADE


#net.ipv4.ip_forward=1

 sudo nano /var/snap/microk8s/current/args/kubelet

 --allowed-unsafe-sysctls=net.ipv4.ip_forward



```shell
helm install wg-easy ./ --namespace wg-easy --create-namespace
```

```shell
kubectl delete ns wg-easy
```

```shell
kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-0 -- ip add
```

```shell
 kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- iptables -t nat -L -n -v
```

```shell
kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- sysctl net.ipv4.ip_forward
```

```shell
 kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- sysctl net.ipv4.conf.all.src_valid_mark
```

```shell
kubectl -n wg-easy logs -f wg-easy-0
```

```shell
kubectl -n wg-easy get pvc,pod,svc
```



# Rout traffic

## Systemd service

lets create a file `/etc/systemd/system/wireguard-masquerade.service`

```shell
sudo nano /etc/systemd/system/wireguard-masquerade.service
```

replace `<host-interface>` with your network card like `eth0`

```
[Unit] 
Description=WireGuard MASQUERADE for 10.8.0.0/24 
After=network.target 

[Service] 
Type=oneshot 
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens192 -j MASQUERADE 
RemainAfterExit=yes 

[Install] 
WantedBy=multi-user.target
```

## Enable

```shell
sudo systemctl enable wireguard-masquerade
```

## Start

```shell
sudo systemctl start wireguard-masquerade
```

swordsteel@microk8s:~$ sudo systemctl enable wg-masquerade
Failed to enable unit: File wg-masquerade.service: Bad message



---

# WireGuard



```shell
helm install wg-easy ./helm --namespace wireguard --create-namespace
```

```shell
helm -n wireguard upgrade wg-easy .\helm\
```

```shell
kubectl -n wireguard get pvc,pod,svc
```

```shell
kubectl -n wireguard logs -f wg-easy-0
```

```shell
kubectl delete ns wireguard
```

```shell
kubectl get ns
```

```shell
kubectl -n wireguard describe pod wg-easy-wg-easy-0
```