iTranslated by AI

The content below is an AI-generated translation. This is an experimental feature, and may contain errors. View original article
🛠️

Using VPG SIM-Based Routing with the Century Systems MA-S120

に公開
Network
SORACOM
routing
vpg
mas120
tech

Goal

From a PC with internet access, use SORACOM and VPG's SIM-based routing functionality to access devices on the LAN connected to the MA-S120 using the LAN's subnet IP address.
In more technical terms, we will explain a configuration where a PC connects to SORACOM's VPG via WireGuard / SORACOM Arc, and then reaches a Raspberry Pi under the MA-S120 via the route on the SORACOM Air (cellular) side accommodated in the VPG. By placing the VPG at the core, it becomes easier to perform reachability control, security control, and monitoring centered on the SIM (line).

Configuration

alt text
From a PC with a SORACOM Arc vSIM, communication is routed to the Raspberry Pi under the MA-S120 that contains the SORACOM Air, without DNAT.

Component Explanation

  • LAPTOP:
    • Securely connects to the VPG via WireGuard / SORACOM Arc from the office/home, etc.
    • Routes traffic destined for the target Raspberry Pi into the tunnel.
  • VPG (Type-F):
    • The core of the private network. It terminates Arc/WireGuard and accommodates Air sessions.
    • Can be linked to SIM groups, enabling SIM-based route control and access control.
  • SORACOM Air (SIM):
    • A line that is taken into the VPG via cellular.
    • Accommodated as the mobile-side session of the router (MA-S120).
  • Router (MA-S120):
    • LTE router. Relays cellular (WAN) and LAN.
    • Accommodates the Raspberry Pi and is key to local address design.
  • Raspberry Pi:
    • The target edge device to be reached. Connected to the LAN side of the MA-S120.

Background

What is VPG?

https://users.soracom.io/ja-jp/docs/vpg/

What is SIM-based Routing?

https://users.soracom.io/ja-jp/docs/vpg/sim-based-routing/

Preparation

What You Need

  • SORACOM account
  • SORACOM Air for Cellular SIM (Global SIM)
  • MA-S120
  • Raspberry Pi
  • LAN cable
  • Environment with internet access
  • PC

Pre-completed Tasks

This article assumes the following preparations are complete.
Please ensure that the SORACOM Arc virtual SIM on the accessing PC and the SORACOM Air for Cellular SIM belong to the same group and are each in a communicable state.

  • Create SORACOM account

https://users.soracom.io/ja-jp/guides/getting-started/create-account/

  • Purchase a SORACOM Air for Cellular SIM (Global SIM)

https://users.soracom.io/ja-jp/guides/getting-started/buy/

  • Register the purchased SORACOM Air for Cellular SIM in the SORACOM user console

https://users.soracom.io/ja-jp/guides/getting-started/register-sim/

  • Create a SORACOM Arc virtual SIM

https://users.soracom.io/ja-jp/docs/arc/create-virtual-sim/

  • Place the target SIM (SORACOM Air) and virtual SIM (SORACOM Arc) in a group

https://users.soracom.io/ja-jp/docs/group-configuration/configure-group/

  • Install WireGuard or the SORACOM Arc client on the PC

https://users.soracom.io/ja-jp/docs/arc/soratun-overview/

  • Ensure the MA-S120 can connect via mobile using SORACOM Air

https://blog.soracom.com/ja-jp/2023/02/20/ma-s120-introduction/

Procedure

First, let's build the orange path in this diagram.
alt text

  1. Prepare one SORACOM Arc vSIM and one SORACOM Air SIM each, and place them in the same group.
    This time, I created a group called "takao_D2D_test".
    alt text

  2. Create a Type-F VPG.
    alt text
    alt text

  3. Select the appropriate settings to create the VPG.
    Internet Gateway: Either is fine for this procedure. Enable/Disable as needed.
    Rendezvous Point: Select based on the SIM subscription. plan01s -> Nearest location, planX3 -> Frankfurt
    Device Subnet Range: I set it to 172.16.0.0/12 (Class B) this time.
    Select an appropriate range according to your network design.
    alt text

  4. Establish VPG
    alt text

  5. Link the group to the VPG.
    alt text

  6. The VPG and group are now linked.
    alt text
    However, at this point, the SIM and vSIM are not yet connected to the VPG.
    The IP address is still 10.xx.xx.xx, but when the session is disconnected and reconnected with a new session, it will be connected to this VPG and become 172.16.0.0/12.
    It is no exaggeration to say that a SORACOM session is a session with the VPG.

  7. Disconnect the session.
    Check the box,
    alt text
    Select "Operation" -> "Disconnect Session".
    alt text
    alt text

  8. After a while, when both come back online, verify that the IP addresses have been updated.
    alt text

  9. Update the SORACOM Arc connection information.
    Open the Virtual SIM tab in the SIM details, and copy the WireGuard configuration.
    alt text
    Update everything from the line Address = downward.
    alt text

Furthermore, add 172.16.0.0/12 and 192.168.100.0/24 to the AllowedIPs = line.
alt text

  1. Connect WireGuard on the PC and verify that you can connect to SORACOM.
    Let's ping pong.soracom.io.
takao@TakaonoMacBook-Pro ~ % ping pong.soracom.io
PING pong.soracom.io (100.127.100.127): 56 data bytes
64 bytes from 100.127.100.127: icmp_seq=0 ttl=64 time=253.293 ms
64 bytes from 100.127.100.127: icmp_seq=1 ttl=64 time=252.442 ms
64 bytes from 100.127.100.127: icmp_seq=2 ttl=64 time=260.202 ms
64 bytes from 100.127.100.127: icmp_seq=3 ttl=64 time=250.905 ms
64 bytes from 100.127.100.127: icmp_seq=4 ttl=64 time=266.012 ms
^C
--- pong.soracom.io ping statistics ---
5 packets transmitted, 5 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 250.905/256.571/266.012/5.696 ms
takao@TakaonoMacBook-Pro ~ %

The round trip from Japan to Frankfurt seems to take about 250ms. A speed that would surprise even Lufthansa.

At this point, let's try pinging the MA-S120's IP address.

takao@TakaonoMacBook-Pro ~ % ping 172.29.220.112
PING 172.29.220.112 (172.29.220.112): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
^C
--- 172.29.220.112 ping statistics ---
5 packets transmitted, 0 packets received, 100.0% packet loss
takao@TakaonoMacBook-Pro ~ %

It is correct that it doesn't respond. This is because the VPG's inter-SIM communication feature is not yet enabled.

  1. Return to the VPG settings and enable inter-SIM communication.
    Open "Device LAN Settings".
    alt text

  2. Turn ON "Enable SORACOM Gate C2D / D2D" and save.
    alt text

Now let's ping the MA-S120 again.

takao@TakaonoMacBook-Pro ~ % ping 172.29.220.112
PING 172.29.220.112 (172.29.220.112): 56 data bytes
Request timeout for icmp_seq 0
64 bytes from 172.29.220.112: icmp_seq=0 ttl=255 time=1604.688 ms
64 bytes from 172.29.220.112: icmp_seq=1 ttl=255 time=604.462 ms
64 bytes from 172.29.220.112: icmp_seq=2 ttl=255 time=495.460 ms
64 bytes from 172.29.220.112: icmp_seq=3 ttl=255 time=550.525 ms
64 bytes from 172.29.220.112: icmp_seq=4 ttl=255 time=490.329 ms
64 bytes from 172.29.220.112: icmp_seq=5 ttl=255 time=496.360 ms
^C
--- 172.29.220.112 ping statistics ---
7 packets transmitted, 6 packets received, 14.3% packet loss
round-trip min/avg/max/stddev = 490.329/706.971/1604.688/403.507 ms
takao@TakaonoMacBook-Pro ~ %

This time, a response came back.

That's all good for now.
Next, we will configure the MA-S120.
Keep this screen open as we will come back to it later.

2. Basic Configuration of MA-S120

Configure the router to forward packets from the WAN side to the LAN side.
alt text
The settings are for routing the orange line in the diagram above.

Let's confirm once again that this step has been completed.

  1. Connect a Raspberry Pi downstream of the MA-S120.

  2. Launch Chromium from the Raspberry Pi desktop and access the MA-S120 management screen.
    (At this point, the MA-S120's eth0 should be 192.168.253.253 (default), and the Raspberry Pi's eth0 should be statically set to 192.168.253.250.)

  3. Log in to the MA-S120 UI management screen at https://192.168.253.253.
    alt text

  4. Open "Ethernet Settings" from "Network Settings".

  • ifup Method: Static
  • IP Address: 192.168.100.1
  • Netmask: 255.255.255.0
    Leave "Apply Immediately" OFF and click "Settings".
    alt text
  1. Configure the DHCP server.
    This time, we will assign an IP address to the Raspberry Pi via DHCP.
    Open "DHCP Server Settings" from "Network Settings".
  • Interface to configure: eth0
  • Lease range (start address): 192.168.100.2
  • Lease range (end address): 192.168.100.254
    Turn ON "Enable on eth0", then click "Settings".
    After that, click "Start" to start the DHCP server.

At this point, the DHCP server is not yet running; it will start after a reboot.
alt text

  1. Reboot
    Click the power icon and then "REBOOT".
    alt text
    alt text

3. Raspberry Pi Network Settings

Continuing with the configuration to allow the orange line in the diagram below.
alt text

  1. Set the Raspberry Pi's eth0 to DHCP.
    alt text
    Verify that the IP address becomes 192.168.100.x.
    alt text
    In this case, 192.168.100.10 was assigned.
    Note down the MAC address as it will be needed later.

  2. Configure the MA-S120's DHCP server to always assign 192.168.100.10 to the Raspberry Pi by associating the MAC address with the IP address.

  3. Connect a console cable to the PC.
    Reference: https://ma-tech.centurysys.jp/doku.php?id=console_ssh_login:start

  4. Connect to the serial console using a terminal software.
    For macOS:

screen /dev/tty.usbserial-xxxx 115200

For Windows:
Connect using terminal software such as Tera Term.

  1. Log in as root.
    After logging in, confirm that root@gemini:~# is displayed.

  2. Associate the Raspberry Pi's MAC address with the IP address using dnsmasq.
    Edit /etc/dnsmasq.conf with a suitable editor.
    Add the following line to the end of the file:

dhcp-host=<Raspberry Pi MAC address>,192.168.100.100

Use the MAC address you noted down earlier.
I set the IP address to 192.168.100.100, but you can specify any address within the 192.168.100.0/24 range.
alt text
After editing, save and exit.

  1. Restart dnsmasq.
systemctl restart dnsmasq

alt text
No response (no error means it's OK).

  1. Verify that the Raspberry Pi's IP address has changed.
    alt text
    Previously it was 192.168.100.10, but now it has changed to 192.168.100.100.

4. SIM-Based Routing Configuration and Verification

Configure the VPG and router to route packets destined for the LAN subnet through the router.
These settings are for passing through the orange line in the diagram below.
alt text

  1. Try pinging the Raspberry Pi from the PC with SORACOM Arc enabled.
takao@TakaonoMacBook-Pro ~ % ping 192.168.100.100
PING 192.168.100.100 (192.168.100.100): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
^C
--- 192.168.100.100 ping statistics ---
5 packets transmitted, 0 packets received, 100.0% packet loss
takao@TakaonoMacBook-Pro ~ %

It is correct that it doesn't respond. This is because inter-SIM communication on the VPG is enabled, but SIM-based routing is not yet enabled.

  1. Return to the VPG settings and enable SIM-based routing.
    Open "Device LAN Settings",
    alt text
    Now configure "SIM Based Routing".

  2. Click "Add" in the routing settings.
    alt text

  3. Specify the IP address range and SIM in the displayed input fields.
    IP address range: 192.168.100.0/24
    SIM: Specify the SORACOM Air SIM inserted into the MA-S120.
    alt text
    Click the save button at the bottom left.

  4. Enable SIM-based routing.
    alt text
    After this, disconnect and reconnect both the SORACOM Air and SORACOM Arc sessions.
    alt text

At this point, try pinging the Raspberry Pi from the PC with SORACOM Arc.

takao@TakaonoMacBook-Pro ~ % ping 192.168.100.100
PING 192.168.100.100 (192.168.100.100): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
Request timeout for icmp_seq 4
Request timeout for icmp_seq 5
Request timeout for icmp_seq 6
^C
--- 192.168.100.100 ping statistics ---
8 packets transmitted, 0 packets received, 100.0% packet loss
takao@TakaonoMacBook-Pro ~ %

Still not working. This is likely because the MA-S120 is not processing this packet.

  1. Add routing rules to the MA-S120's iptables.
    Open the webUI "Network Settings" -> "Firewall Settings" -> "Filter Settings".
    Configure as follows:
    In Zone: WAN
    Out Zone: LAN
    Service: ICMP
    Protocol: Select by Service
    Action: ACCEPT
    Click "Add".
    alt text
    After configuration, it should look like this:
    alt text

  2. Finally, try pinging the Raspberry Pi from the PC again.

takao@TakaonoMacBook-Pro ~ % ping 192.168.100.100
PING 192.168.100.100 (192.168.100.100): 56 data bytes
Request timeout for icmp_seq 0
64 bytes from 192.168.100.100: icmp_seq=0 ttl=62 time=1356.979 ms
64 bytes from 192.168.100.100: icmp_seq=1 ttl=62 time=491.483 ms
64 bytes from 192.168.100.100: icmp_seq=2 ttl=62 time=506.034 ms
64 bytes from 192.168.100.100: icmp_seq=3 ttl=62 time=500.845 ms
64 bytes from 192.168.100.100: icmp_seq=4 ttl=62 time=496.157 ms
64 bytes from 192.168.100.100: icmp_seq=5 ttl=62 time=491.567 ms
^C
--- 192.168.100.100 ping statistics ---
7 packets transmitted, 6 packets received, 14.3% packet loss
round-trip min/avg/max/stddev = 491.483/640.511/1356.979/320.455 ms
takao@TakaonoMacBook-Pro ~ %

It works. Congratulations!

Now, configure iptables on the MA-S120 to allow any necessary protocols.
For example, if you are running a web server on the Raspberry Pi, allow HTTP; if you want to SSH into the Raspberry Pi, allow SSH.
If you set it up like this,
alt text

You can SSH into the Raspberry Pi at 192.168.100.100,
alt text

or access the web server at http://192.168.100.100 (if Apache2 is running).
alt text

5. NAT Configuration (Advanced)

Now you can access the Raspberry Pi from SORACOM Arc, but what about communication from the Raspberry Pi to SORACOM Arc?
Let's try pinging the Arc's IP address.
alt text
It works.

Let's check the received PING packets on the PC side.

Run the following command on the PC:

sudo tcpdump -ni utun4 'icmp'

utun4 is the SORACOM Arc interface in my environment. It may differ depending on your environment, so check with ifconfig.
This captures ICMP packets flowing into this interface.

Send a ping from the Raspberry Pi side.
alt text

Interestingly, the source IP address received on the SORACOM Arc PC side is 172.29.220.112.
This is the IP address of the MA-S120's ppp0 interface.
Therefore, packets from the Raspberry Pi reach the VPG via the MA-S120, but the source IP address is translated to the MA-S120's IP address as seen by the VPG.

In other words, this is what happens:
alt text

In scenarios using SIM-based routing, you may want to translate the source IP address of edge devices like the Raspberry Pi under the MA-S120 to the local IP address when connecting to other devices connected to the VPG.

In this case, change the NAT settings on the MA-S120.
Assuming use in a closed network, configure so that the source IP address of packets going out through the MA-S120's ppp0 interface is not NATed.
Run the following command on the console:

iptables -t nat -D POSTROUTING -o ppp0 -j MASQUERADE

Persist the settings with the following command:

sudo iptables-save | sudo tee /etc/iptables/rules-save

Now try pinging from the Raspberry Pi again.

If the source IP address received on the SORACOM Arc PC side has changed to 192.168.100.100, it is successful.

alt text

Thank you for your hard work!

appendix

Configuration Checkpoints

SORACOM

  • VPG

    • Type must be Type-F
    • Device Subnet Range: Must match the range of IP addresses actually assigned to SIM/vSIM
    • Basic Settings: The group using this VPG must be linked to the configured group
    • Privacy Separator: Checkbox OFF alt text
    • Device LAN Settings
      • Enable SORACOM Gate C2D / D2D: ON
      • SIM Based Routing: Routing Settings
        • IP Address Range: Must match the LAN subnet of the MA-S120
        • SIM ID: Must specify the SORACOM Air SIM inserted into the MA-S120
          alt text

  • SIM Management Screen

    • Group: The SORACOM Air SIM and SORACOM Arc vSIM must belong to the same group
    • Status: Must be Online
    • IP Address: Must be within the VPG's Device Subnet Range
      alt text

  • SIM Group

    • SORACOM Air for Cellular Settings: VPG ID must be correctly configured
      alt text

  • SIM Detail Screen

    • SIM
      • Session Details tab: Session History
        • VPG: The created VPG ID must be displayed
          alt text
    • vSIM
      • Session Details tab: Session History
        • VPG: The created VPG ID must be displayed
          alt text
      • Virtual SIM tab: Session
        The WireGuard configuration information must match what is entered in the WireGuard client
        (The WireGuard client should contain the router's local IP range and the device subnet range in addition to the displayed information in AllowedIPs)
        It is also effective to reset the virtual SIM session from this screen if needed
        alt text

  • WireGuard Client Software Configuration

    • The SORACOM Arc vSIM configuration information must be correct
    • AllowedIPs must include the router's local IP range and the device subnet range
      alt text

  • Network Settings

    • Ethernet Settings

      • ifup Method must be Static with an IP Address within the IP address range specified in the SIM-based routing settings
        alt text
      • Ensure the settings are applied to the device (e.g., clicking the Settings button again)

    • LTE Settings

      • Connection Settings

        • SORACOM APN must be correctly configured
        • Must be selected as the default route
        • Ensure the settings are applied to the device (e.g., clicking the Settings button again)
          alt text

      • Status & Control

        • IMSI and ICCID must be correctly displayed and match the SIM detail screen on the user console
        • IP Address must be within the VPG's device subnet range
          alt text

    • Firewall Settings

      • Filter Settings
        • The desired protocol/port must be allowed
          alt text
      • Ensure the settings are applied to the device (e.g., clicking the Settings button again)

    • DHCP Server Settings

      • DHCP Lease Settings
        • DHCP server must be enabled on eth0
        • Lease range must be within the MA-S120's LAN subnet
          alt text
        • Ensure the settings are applied to the device (e.g., clicking the Settings button again)
      • Status
        • The desired IP addresses must be assigned to downstream devices
          alt text

Default MA-S120 Configuration

Configuration Details (click to expand)
Ubuntu 22.04.5 LTS gemini ttyS0

gemini login: root  
Password: 
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.105 armv7l)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

root@gemini:~# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.253.253  netmask 255.255.255.0  broadcast 192.168.253.255
        inet6 fe80::280:6dff:fea3:7b6  prefixlen 64  scopeid 0x20<link>
        ether 00:80:6d:xx:xx:xx  txqueuelen 1000  (Ethernet)
        RX packets 5  bytes 1615 (1.6 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 9  bytes 762 (762.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 27  base 0x8000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 39  bytes 2940 (2.9 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 39  bytes 2940 (2.9 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

root@gemini:~#

Routing related

root@gemini:~# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
root@gemini:~# sudo iptables -S FORWARD
-P FORWARD DROP
-A FORWARD -m conntrack --ctstate ESTABLISHED -j ACCEPT
-A FORWARD -p icmp -j icmp-routing
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -i br0 -j ACCEPT
-A FORWARD -i ppp100 -j ACCEPT
-A FORWARD -o eth0 -j ACCEPT
-A FORWARD -o br0 -j ACCEPT
-A FORWARD -o ppp100 -j ACCEPT
-A FORWARD -i ppp0 -j logdrop-0
-A FORWARD -i ppp1 -j logdrop-0
-A FORWARD -i usb0 -j logdrop-0
-A FORWARD -i wlan0 -j logdrop-0
-A FORWARD -i eth1 -j ACCEPT
-A FORWARD -i wg+ -j ACCEPT
-A FORWARD -i wlisc -j ACCEPT
-A FORWARD -o eth1 -j ACCEPT
-A FORWARD -o wg+ -j ACCEPT
-A FORWARD -o wlisc -j ACCEPT
root@gemini:~# sudo iptables -L FORWARD -n -v
Chain FORWARD (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate ESTABLISHED
    0     0 icmp-routing  icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  ppp100 *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      br0     0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      ppp100  0.0.0.0/0            0.0.0.0/0           
    0     0 logdrop-0  all  --  ppp0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 logdrop-0  all  --  ppp1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 logdrop-0  all  --  usb0   *       0.0.0.0/0            0.0.0.0/0           
    0     0 logdrop-0  all  --  wlan0  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  wg+    *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  wlisc  *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      eth1    0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      wg+     0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  *      wlisc   0.0.0.0/0            0.0.0.0/0           
root@gemini:~# sysctl net.ipv4.conf.all.rp_filter
net.ipv4.conf.all.rp_filter = 2

NAT settings

root@gemini:~# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N awall-masquerade
-A POSTROUTING -o ppp0 -j MASQUERADE
-A POSTROUTING -o ppp1 -j MASQUERADE
-A POSTROUTING -o usb0 -j MASQUERADE
-A POSTROUTING -o wlan0 -j MASQUERADE
-A POSTROUTING -o eth1 -j MASQUERADE
-A POSTROUTING -o wg+ -j MASQUERADE
-A POSTROUTING -o wlisc -j MASQUERADE
-A POSTROUTING -m set --match-set awall-masquerade src -j awall-masquerade
-A awall-masquerade -m set ! --match-set awall-masquerade dst -j MASQUERADE
root@gemini:~#
GitHubで編集を提案

Discussion