Check if traffic hits the pod

kubectl -n wg-easy exec -it wg-easy-wg-easy-0 -- wg show

microk8s kubectl -n wg-easy exec -it wg-easy-wg-easy-0 -- iptables -t nat -L -n -v | grep 10.8

sudo iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens192 -j MASQUERADE

#net.ipv4.ip_forward=1

sudo nano /var/snap/microk8s/current/args/kubelet

--allowed-unsafe-sysctls=net.ipv4.ip_forward

helm install wg-easy ./ --namespace wg-easy --create-namespace

kubectl delete ns wg-easy

kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-0 -- ip add

 kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- iptables -t nat -L -n -v

kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- sysctl net.ipv4.ip_forward

 kubectl -n wg-easy exec -it pod/wg-easy-wg-easy-6bcdd9fcb4-7xt94 -- sysctl net.ipv4.conf.all.src_valid_mark

kubectl -n wg-easy logs -f wg-easy-0

kubectl -n wg-easy get pvc,pod,svc

Rout traffic

Systemd service

lets create a file /etc/systemd/system/wireguard-masquerade.service

sudo nano /etc/systemd/system/wireguard-masquerade.service

replace <host-interface> with your network card like eth0

[Unit] 
Description=WireGuard MASQUERADE for 10.8.0.0/24 
After=network.target 

[Service] 
Type=oneshot 
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ens192 -j MASQUERADE 
RemainAfterExit=yes 

[Install] 
WantedBy=multi-user.target

Enable

sudo systemctl enable wireguard-masquerade

Start

sudo systemctl start wireguard-masquerade

swordsteel@microk8s:~$ sudo systemctl enable wg-masquerade Failed to enable unit: File wg-masquerade.service: Bad message

---

WireGuard

helm install wg-easy ./helm --namespace wireguard --create-namespace

helm -n wireguard upgrade wg-easy .\helm\

kubectl -n wireguard get pvc,pod,svc

kubectl -n wireguard logs -f wg-easy-0

kubectl delete ns wireguard

kubectl get ns

kubectl -n wireguard describe pod wg-easy-wg-easy-0