title: wireguard client not connecting to the internet
body: <p>For all its purpoted simplicity I am simply unable to setup wireguard such that a client can access the internet (WAN) through the wireguard VPN. I have googled for a couple of days and nothing has worked. I have my configuration here below, could anybody see what might be wrong?</p>
  <ul>
  <li>wireguard configuration on the server</li>
  <li>as you can see I have tried to set AllowedIPs to 0.0.0.0/0 as well to no avail. It looks though that with 0.0.0.0/0 a traceroute to facebook's IP (176.13.69.63) works but I cannot reach it otherwise.</li>
  </ul>
  <pre><code>    root@hattusa:~# cat /etc/wireguard/wg0.conf
      [Interface]
      PrivateKey = ***
      Address = 10.6.0.1/24
      ListenPort = 8765
  
      ### begin android ###
      [Peer]
      PublicKey = ***
      PresharedKey = ***
      #AllowedIPs = 0.0.0.0/0
      AllowedIPs = 10.6.0.2/32
      ### end android ###
  </code></pre>
  <ul>
  <li>wireguard client configuration</li>
  </ul>
  <pre><code>    root@hattusa:~# cat /etc/wireguard/configs/android.conf
      [Interface]
      PrivateKey = ***
      Address = 10.6.0.2/24
      DNS = 8.8.8.8, 8.8.4.4
  
      [Peer]
      PublicKey = ***
      PresharedKey = ***
      Endpoint = ***:8765
      AllowedIPs = 0.0.0.0/0, ::0/0
  </code></pre>
  <ul>
  <li>ipv4 forwarding is enabled</li>
  </ul>
  <pre><code>    root@hattusa:~# sysctl net.ipv4.ip_forward
      net.ipv4.ip_forward = 1
  </code></pre>
  <ul>
  <li>I have tried different iptables rules, what I have added now is; I don't have a firewall running</li>
  </ul>
  <pre><code>    root@hattusa:~# iptables --list-rules
      -P INPUT ACCEPT
      -P FORWARD ACCEPT
      -P OUTPUT ACCEPT
      -A INPUT -i eth0 -p udp -m udp --dport 8765 -j ACCEPT
      -A INPUT -i wg0 -j ACCEPT
      -A FORWARD -i wg0 -o eth0 -j ACCEPT
      -A FORWARD -i eth0 -o wg0 -j ACCEPT
  </code></pre>
  <ul>
  <li>I also have a masquerade rule but it doesn't show up. It is</li>
  </ul>
  <pre><code>    iptables -t nat -I POSTROUTING 1 -s 10.6.0.2/24 -o eth0 -j MASQUERADE
  </code></pre>
  <ul>
  <li>the client can connect successfully, data is being sent and received and ping works from client as well (so DNS resolving is okay, but even if DNS is not working I should be able to reach hosts directly by IP)</li>
  </ul>
  <pre><code>    root@hattusa:~# wg
      interface: wg0
        public key: ***
        private key: (hidden)
        listening port: 8765
  
      peer: ***=
        preshared key: (hidden)
        endpoint: ***:31053
        allowed ips: 10.6.0.2/32
        latest handshake: 12 minutes, 32 seconds ago
        transfer: 1.32 MiB received, 2.13 MiB sent
  </code></pre>
  <ul>
  <li>running debian buster on raspbian, port 8765 is open on the router both UDP and TCP (otherwise client won't be able to connect externally)</li>
  </ul>