February 10, 20251 yr Rant: Hi, I am new to unraid (just 1-2 weeks in) and networking in general. My purpose is to setup unraid as NAS, VPN with AdGuard working. I am having really hard time setting things up. I watched all the youtube videos before taking every step but it worked alright while setting Array and disks but nothing else worked as it just did on the videos. I looked up in the forum and on reddit where people have similar issues but couldn't find a solution. I apologize in advance if its already been answered Issue: I have a WireGuard tunnel on unRAID set to “Remote Tunneled Access” (with NAT enabled). My phone successfully connects (I can reach my unRAID share on 192.168.1.27), but all Internet traffic and access to 192.168.1.1 fails. Traceroutes stop at 10.253.0.1, meaning unRAID isn’t forwarding traffic onward to the router. Basic Setup: unRAID WireGuard: “Remote Tunneled Access” + “Local server uses NAT: Yes” Phone client: AllowedIPs = 0.0.0.0/0 Symptoms: SMB shares on 192.168.1.27 work. Router web UI (192.168.1.1) times out. Pings to public IPs (e.g., 1.1.1.1) fail, tracert only shows 10.253.0.1. What I’ve Tried So Far: Changing DNS to public (1.1.1.1) on both server and phone. Verifying phone’s AllowedIPs includes 0.0.0.0/0. root@atlantis:~# cat /etc/wireguard/wg0.conf [Interface] #unraidVPN PrivateKey=xx Address=10.253.0.1 ListenPort=51820 PostUp=logger -t wireguard -- 'Tunnel WireGuard-wg0 started';/usr/local/emhttp/webGui/scripts/update_services PostUp=iptables -t nat -A POSTROUTING -s 10.253.0.0/24 -o br0 -j MASQUERADE;iptables -t nat -A POSTROUTING -s 10.253.0.0/24 -o vhost0 -j MASQUERADE PostDown=logger -t wireguard -- 'Tunnel WireGuard-wg0 stopped';/usr/local/emhttp/webGui/scripts/update_services PostDown=iptables -t nat -D POSTROUTING -s 10.253.0.0/24 -o br0 -j MASQUERADE;iptables -t nat -D POSTROUTING -s 10.253.0.0/24 -o vhost0 -j MASQUERADE PostUp=ip -4 route flush table 200 PostUp=ip -4 route add default via 10.253.0.1 dev wg0 table 200 PostUp=ip -4 route add 192.168.1.0/24 via 192.168.1.1 dev br0 table 200 PostDown=ip -4 route flush table 200 PostDown=ip -4 route add unreachable default table 200 PostDown=ip -4 route add 192.168.1.0/24 via 192.168.1.1 dev br0 table 200 [Peer] #phone PublicKey=xx PresharedKey=xx AllowedIPs=10.253.0.2 Edited February 10, 20251 yr by atlantis4547
February 10, 20251 yr Community Expert I would recommend trying the Tailscale plugin, runs on top of Wireguard, but it's much easier to set up.
February 11, 20251 yr Author Solution Thanks, I looked into that. The thing is I am also not familiar with Tailscale and it seems I will have to pay for it if I want more than 3 users to share my NAS/VPN. I was finally figure it out from here https://docs.unraid.net/unraid-os/manual/security/vpn/#complex-networks , It seems I was not looking to the latest docs earlier. The youtube videos and reddit dint really mention these setting at all. Quote Configurations to avoid There are some configurations you'll want to avoid, here is how a few key settings interact: With Use NAT set to Yes and Host access to custom networks set to disabled (static route optional) server and dockers on bridge/host - accessible! VMs and other systems on LAN - accessible! dockers with custom IP - NOT accessible (this is the "simple network" setup assumed by the guide above) With Use NAT set to Yes and Host access to custom networks set to enabled (static route optional) server and dockers on bridge/host - accessible! VMs and other systems on LAN - NOT accessible dockers with custom IP - NOT accessible (avoid this config) With Use NAT set to Noand no static route server and dockers on bridge/host - accessible! VMs and other systems on LAN - NOT accessible dockers with custom IP - NOT accessible (avoid this, if Use NAT = No, you really need to add a static route in your router) With Use NAT set to No and Host access to custom networks set to disabled and static route server and dockers on bridge/host - accessible! VMs and other systems on LAN - accessible! dockers with custom IP - NOT accessible (You've come this far, just set Host access to custom networks to enabled and you're set) With "Use NAT" = No and "Host access to custom networks" = enabled and static route server and dockers on bridge/host - accessible! VMs and other systems on LAN - accessible! dockers with custom IP - accessible! (Bingo! This is the recommended setup for complex networks)
February 11, 20251 yr Community Expert i bet you have host access to custom networks enabled Edit: well duh, you do, the screenshow shows it Edit edit: just tagging you @atlantis4547 Edited February 11, 20251 yr by Mainfrezzer
February 12, 20251 yr 23 hours ago, atlantis4547 said: The thing is I am also not familiar with Tailscale and it seems I will have to pay for it if I want more than 3 users to share my NAS/VPN. Tailscale simplifies *everything*, I'd suggest taking another look. You can share individual machines with as many people as you like for free, so there is generally no need to actually add anyone to your Tailnet, and therefore no cost.
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.