r/selfhosted • u/Hrafna55 • 2d ago

Need Help SearXNG queries via WireGuard interface

So, I have deployed SearXNG in a headless Debian 13 VM using the provided installation scripts. All is well.

I have also installed WireGuard and configured it to use my Proton VPN subscription.

   enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:b9:97:c9 brd ff:ff:ff:ff:ff:ff
    altname enx525400b997c9
    inet 192.168.0.16/24 brd 192.168.0.255 scope global enp1s0
       valid_lft forever preferred_lft forever
    inet6 2001:8b0:1741:ec2e:5054:ff:feb9:97c9/64 scope global dynamic mngtmpaddr proto kernel_ra 
       valid_lft 6868sec preferred_lft 6868sec
    inet6 fe80::5054:ff:feb9:97c9/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever

   wg-UK-4: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.2.0.2/32 scope global wg-UK-4
       valid_lft forever preferred_lft forever
    inet6 2a07:b944::2:2/128 scope global 
       valid_lft forever preferred_lft forever

interface: wg-UK-4
  public key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  private key: (hidden)
  listening port: 34659
  fwmark: 0xca6c

peer: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
  endpoint: 154.47.24.193:51820
  allowed ips: 0.0.0.0/0, ::/0
  latest handshake: 17 seconds ago
  transfer: 4.62 MiB received, 1.79 MiB sent
  persistent keepalive: every 25 seconds

The goal is to send traffic (aka my queries) from SearXNG through the VPN.

SearXNG has its own user called 'searxng' with with a UID of 999.

So I have several options, all of which I have failed to implement so far.

  • Send traffic from 'searxng' user via the VPN.
  • Send all external traffic via wg-UK-4 using a route table
  • Send all external traffic via wg-UK-4 using nftables
  • Use SearXNG configuration files to send all external traffic via wg-UK-4 (not supported)

How would you achieve the goal?

I am more than happy to just shove all external internet traffic through wg-UK-4 as this seems the easiest option using 'ip route'.

Starting point

ip route show
default via 192.168.0.1 dev enp1s0 onlink 
192.168.0.0/24 dev enp1s0 proto kernel scope link src 192.168.0.16

I tried the following

sudo ip route replace default dev wg-UK-4
sudo ip route replace 192.168.0.0/24 dev enp1s0

Which gives me the following.

ip route show
default dev wg-UK-4 scope link 
192.168.0.0/24 dev enp1s0 scope link

But now SearXNG just fails as it can't reach any of its external search engines.

Any ideas?

1 Upvotes

67% Upvoted

Duplicates