# 📘 Guide: Remote Access via PiVPN, Fedora Gateway, and Home NAS

## 1. 🎯 Goal

Allow a remote machine (like a VPS in the US or a laptop in Spain) to connect into your **PiVPN WireGuard server** and then securely access devices on your **home LAN** (such as a NAS).  

**End Flow:**
```
Remote Client (Spain/US VPS)
      ⇩ (WireGuard VPN)
PiVPN Server (UK, 10.138.135.1)
      ⇩ (peer routing)
Fedora VM (VPN: 10.138.135.3 / LAN: 192.168.1.40)
      ⇩
NAS (192.168.1.207, 192.168.1.216, etc.)
```

---

## 2. 🛠️ Prerequisites

Before starting, make sure you have:

### Knowledge
- Ability to log into your servers via SSH.
- Basic Linux familiarity (running commands, editing files).

### Tools
- A **PiVPN server** already set up and working with WireGuard.
- A **Fedora VM** on your home LAN with:
  - One interface in the VPN (`10.138.135.3`).  
  - One interface in the home LAN (`192.168.1.40`).  
- A **NAS** or devices on your home LAN (`192.168.1.x`).
- At least one **remote client** (US VPS, laptop in Spain, etc.).

---

## 3. 🚦 Step-by-Step Setup

### Step 1: Connect Remote Client to VPN
- Place config in `/etc/wireguard/vps.conf`.
- Bring it up:
  ```bash
  sudo wg-quick up vps
  ```
- Verify:
  ```bash
  sudo wg show vps
  ```

✅ You should see a handshake with the PiVPN server.

---

### Step 2: Ensure PiVPN allows peer-to-peer
By default, VPN clients can only talk to the server. Enable forwarding:

1. On **PiVPN server** (`/etc/wireguard/wg0.conf`):
   ```ini
   PostUp   = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT
   PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT
   ```
2. Apply:
   ```bash
   sudo sysctl -w net.ipv4.ip_forward=1
   sudo systemctl restart wg-quick@wg0
   ```

---

### Step 3: Advertise the home LAN via Fedora
On the **PiVPN server**, edit the Fedora peer:

```ini
[Peer]
PublicKey = <FedoraPublicKey>
AllowedIPs = 10.138.135.3/32, 192.168.1.0/24
```

This tells the VPN server: *traffic for 192.168.1.x should go to Fedora*.

---

### Step 4: Route home LAN via VPN clients
On your **remote client** (US VPS, Spain laptop), edit config:

```ini
[Peer]
PublicKey = <ServerPublicKey>
AllowedIPs = 10.138.135.0/24, 192.168.1.0/24
```

Reconnect:
```bash
sudo wg-quick down vps
sudo wg-quick up vps
```

Now the client knows to send home LAN traffic into the VPN.

---

### Step 5: Enable forwarding & NAT on Fedora
Fedora needs to pass packets between VPN (`fedora`) and LAN (`ens18`).

```bash
# Enable forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Allow forwarding
sudo iptables -A FORWARD -i fedora -o ens18 -j ACCEPT
sudo iptables -A FORWARD -i ens18 -o fedora -j ACCEPT

# NAT VPN subnet → Fedora LAN IP
sudo iptables -t nat -A POSTROUTING -s 10.138.135.0/24 -o ens18 -j MASQUERADE
```

---

### Step 6: Test connectivity
From **remote client**:
```bash
ping 192.168.1.40    # Fedora LAN IP
ping 192.168.1.207  # NAS
ping 192.168.1.216  # Another LAN device
```

✅ If Fedora responds but NAS doesn’t → NAT rule missing.  
✅ If all respond → setup complete.

---

## 4. 🔄 Making NAT Permanent (Fedora)

By default, Fedora forgets iptables rules after reboot.  

### Option A (simple, legacy)
```bash
sudo dnf install -y iptables-services
sudo service iptables save
sudo systemctl enable iptables
```

### Option B (modern, nftables)
Edit `/etc/nftables.conf`:
```nft
table ip nat {
    chain postrouting {
        type nat hook postrouting priority 100;
        ip saddr 10.138.135.0/24 oifname "ens18" masquerade
    }
}
```

Apply:
```bash
sudo systemctl enable nftables
sudo systemctl restart nftables
```

---

## 5. 🔎 Troubleshooting Flow

```
[1] VPN up?   → sudo wg show
         ↓
[2] Can ping Fedora VPN IP (10.138.135.3)?
         ↓
[3] Can ping Fedora LAN IP (192.168.1.40)?
         ↓
[4] Can ping NAS (192.168.1.x)?
     ↙               ↘
  No → Check NAT      Yes → Success 🎉
```

---

## 6. ✅ End State

- Remote clients reach Fedora and all devices on home LAN.  
- Fedora acts as NAT gateway.  
- NAT persists across reboot.  
- SSH works on Fedora via port `54321`.  
- No DNS/IP leaks — traffic exits via PiVPN server.  
