PVE Host cannot reach WireGuard peer through LXC container tunnel: fix the routing

PVE host cannot reach WireGuard peer through LXC container tunnel? It’s almost always a missing route on the host or forwarding not enabled in the container. Here’s the exact fix.

Why the host can’t reach the peer

The LXC container has the WireGuard interface and can reach the peer fine. The host doesn’t know to send traffic for the peer’s subnet through the container’s IP. You need a static route on the PVE host pointing to the container’s address.

Fix it in two steps

1. Enable IP forwarding in the container. Add this to /etc/sysctl.conf inside the container:

   net.ipv4.ip_forward=1

   Then run sysctl -p.

2. Add a static route on the PVE host. Replace 10.10.10.0/24 with the peer’s subnet and 192.168.1.100 with the container’s IP on the host’s bridge:

   ip route add 10.10.10.0/24 via 192.168.1.100 dev vmbr0

   To make it persistent, add the route to /etc/network/interfaces under the bridge stanza:

   post-up ip route add 10.10.10.0/24 via 192.168.1.100 dev vmbr0

Test with ping from the host to a peer IP. If it fails, check that the container’s firewall allows forwarding and that the WireGuard peer has a route back to the host’s subnet.

My take

This is a routing problem, not a WireGuard problem. The container does the tunneling; the host just needs a nudge to send traffic to the container. Keep it simple—don’t mess with NAT unless you have overlapping subnets.

If you’re already running Traefik in a container, you know how useful LXC can be. Check out Proxmox as provider: Traefik auto-discovery without an official provider for more container routing tricks.