DS220+ error iptables ?

[emanuelegori]

$ sudo wg-quick up /etc/wireguard/wg0.conf

[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.10.10.2/24 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] wg set wg0 fwmark 51820
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
[#] iptables-restore -n
iptables-restore v1.8.3 (legacy): iptables-restore: unable to initialize table 'raw'

Error occurred at line: 2
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
[#] ip -4 rule delete table 51820
[#] ip -4 rule delete table main suppress_prefixlength 0
[#] ip link delete dev wg0

[fabiov64]

For providing the solution we need a crystal ball. Or the content of the wg0.conf file ...

[diegoperu]

I believe the kernel is so ancient that does not support the raw table... I have the same issue.

[fabiov64]

Yes, you're right. And also compiling an ip_raw.ko module does not solve the issue. But there is a well known workaround consisting in adding a row like:
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1
This allows to connect to a VPN service redirecting all the traffic.

[diegoperu]

I tried that but It always fail with that error. My redacted wg0 config is this, maybe I'm doing something wrong...
`[Interface]
PrivateKey = xxx
Address = 192.168.1.205/24,fdfe:d8cf:5b05::205/64
#DNS = 192.168.1.2,192.168.1.1,fdfe:d8cf:5b05::3ea6:2fff:fe29:362

[Peer]
PublicKey = yyy
PresharedKey = zzz
AllowedIPs = 192.168.1.0/24,0.0.0.0/0,0.0.0.0/1,128.0.0.0/1,fdfe:d8cf:5b05::/64,::/0
Endpoint = www.xxx.zzz
PersistentKeepalive = 25
`

[fabiov64]

For sure you need to remove the IPV6 related statements, because IPV6 is not supported by this package.

Here the mine (working):

[Interface]
PrivateKey = XXXXXXXX
Address = MyAddressIP/32
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip route add EndPointIP/32 via MyRouterIP dev eth0
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE ; route delete EndPointIP

[Peer]
PublicKey = zzzzzzzzzzzzzz
AllowedIPs = 0.0.0.0/1, 128.0.0.0/1
Endpoint = EndPointIP:Port

[diegoperu]

Thanks, now it's sort of working! I only have to input the correct ips in the routing instruction, but the link is up! Many thanks again!