That is basically routing the traffic from the RaspAP Hotspot (Wi-Fi) to the other network interface (Ethernet) … if the NAT rule (Network Address Translation) would not be there no traffic could flow from one subnet to the other – because Wi-Fi and Ethernet should be on different subnets a rule must allow the traffic exchange between them.

192.168.x.x is a private subnet and everybody can use it internal without creating a conflict on the internet. I think you are right that RaspAP picked this one not to create a conflict in internal LANs. But it’s easy to change and wouldn’t make a difference, I guess.

You’re right! I tried again with a fresh install of Raspian Bullseye lite. I installed RaspAP with default settings, then installed Wireguard and configured it in a basic peer mode. Once I brought the interface up, the wireless access point switched to the foreign IP address. Nothing more is needed! I didn’t do anything to the Pi firewall either. Thanks for your help!

I do have a question though. In the RaspAP installation log, it said “Adding rule: -t nat -A POSTROUTING -j MASQUERADE
Adding rule: -t nat -A POSTROUTING -s 192.168.50.0/24 ! -d 192.168.50.0/24 -j MASQUERADE”

What does this do? I’m curious specifically because of the subnet address in mentions. Is this detecting my subnet? Or is this RaspAP creating a subnet to use for its own purposes?

If this is RaspAP creating a subnet from scratch then this is a concern because my LAN subnet address is EXACTLY THE SAME! And if that’s the case I’m worried about conflicts between the two.

I noticed that exact same subnet address (192.168.50.0) on the screenshot of your RaspAP install log >> https://vpn-expert.info/wp-content/uploads/2020/01/raspap-installation-control-service.png

So either by random chance you have the same less common subnet address as me (I chose mine because it seemed a little different from the usual 192.68.0.1, etc), or this is RaspAP creating one that the devs assume is a little different so as to not conflict with the more common ones. If that’s the case, how do I change the RaspAP one?

The iptables command was only necessary because the NordVPN client changed some settings. In your case, this part might not be necessary at all. You might need to allow the port you are using for your WireGuard connection – default is 51820 UDP.

The WireGuard connection you could automatically start with systemctl enable wg-quick@wg0 for example (where wg0 is the name of your connection – might be different in your case) … but that depends a bit on the Linux distribution you are using.

PS – Ugh this all posted as one large paragraph. I submitted it as separate paragraphs. Sorry.

I’ve installed RaspAP. I can connect to the RaspAP access point and browse the internet.

I’ve installed Wireguard on the Pi and have it set up as a peer. I’ve confirmed the Wireguard is connected by running the command…
host myip.opendns.com resolver1.opendns.com | grep “myip.opendns.com has” | awk ‘{print $4}’
… which reports that the IP address is now located in the other country.

I’m stuck at how to configure iptables (including what exactly goes into script that’s run by cron, including if this is where I launch Wireguard).

Your guide below mentions nordlynx as the interface, but again I’m not using that and I’m not very familiar with iptables. I ran your iptables commands (replacing nordlynx with wg0) and it worked, but it didnt survive a reboot and now no longer works. I’m at a loss.

I’m also unsure when to run wireguard – is this run from the cron script, and if so, how?

The RaspAP documentation gives a hint as to what to use at https://docs.raspap.com/wireguard, but it also mentions PostUp and PostDown needs configuring yet doesn’t say a damn thing about what actually is needed. But maybe I don’t need that because I’m not interested in using it as a server, but as a client so I can watch foreign TV from my Apple TV.

Any help is appreciated.

Doesn’t work with newer clients of ExpressVPN because they set force_vpn_dns to true, and you cannot deactivate it. Meaning – as soon as you activate the Linux client on your Desktop you cannot reach your Pi-hole. However, I haven’t tried running ExpressVPN on a Pi-hole server … I don’t use it because I can’t configure my own DNS servers and because it is now part of Kape Technologies – former the adware / malware distributor Crossrider – too many red flags for me.

Furthermore, from my long years of IT experience I normally live with compromises instead of trying to create a “jack of all trades”.

NordVPN you can use Pi-hole as you can set the DNS server yourself, or you simply use CyberSec as that is the built in ad blocker … if you would use that on your “VPN Raspberry Pi router” with activated CyberSec or a Pi-hole and another VPN on your client … you are pretty much where you want to be – if I did understand you correctly.

My Requirementsa. I want all my traffic to be encrypted and anonymous b. I want to be able to turn off and on my client side VPN if a site doesn’t work with the VPN , without breaking PI-Hole (I want Pi-hole for the ad-blocking)c. I don’t want to use the PI as a VPN gateway for all my network traffic. ( I use split tunneling for specific apps on the client side. I think server side VPN would be too limiting for my purposes)d. I want to be able to change my client side VPN location
My Thinking1. Run Express VPN on my Client PCs2. Run Express VPN on my Pi-Hole Server3. Be able to turn on and off the VPN on my Client PC, but still have the routing to Pi-Hole work
Questions:1. Is my thinking reasonable, or is there a better/different way to accomplish my requirements.
2. How do I do it? I’m new to linux and need some specific help in identifying the exact routing rules, where to edit them and the exact IP values I need to use (again I’m using OpenVPN on both sides. I want it to work when both VPNs are running as well as when either VPN is turned off)

The 4B is 64-Bit, the 2B might not be – depending on the model … that might be the cause of the error …

Is the firewall option in the NordVPN off?

Do you have the option to try different hardware? It’s a shot in the dark, but it might be a hardware problem.

Really difficult to analyse the problem from remote — I am using exactly the setup I described here, and it works.

The just release Raspberry Pi Zero 2 W might do the trick nicely. For a travel router you probably would need a second Wi-Fi card — a USB Wi-Fi card that basically replaces the Ethernet card in my setup. All you have to do while travelling is connect the gateway Wi-Fi card to the wireless LAN you want to use. The rest should be identical to the tutorial here.

Long story short — yes, it’s a matter of replacing the Ethernet interface with a second Wi-Fi interface.