But, my experience is that the NAT (ICS - Internet Connection Sharing) is not 100% stable. Sometimes just stop working. This was about 6 months ago.
Now I’m about to setup a new server. I have successfully used an Ubuntu VM with WireGuard Server in Hyper-V on Windows. This works 100% with the NAT, very reliable. But I get the overhead of a VM.
I’m seeking advices and experience here before I walk the VM path… Thanks!
just use https://github.com/micahmo/WgServerforWindows for windows deployment it fixes all quirks with ICS, have it on one server persisted through windows updates and all nasty stuff (power outage etc)
Why do you need NAT on the Windows server? Why not assign and use a subnet that is valid for network, and setup routing on the various devices on the network for that subnet.
I suggest trying to avoid NAT as much as possible, only using it on the firewall/router connecting you to the Internet.
I run a VPS with Windows 2016 and all ports open. I do not want to provide access to the VPS local system for my clients - only access to the public internet.
Will I still be faced with the same issues highlighted in this post if I use WgServerforWindows?
https://github.com/micahmo/WgServerforWindows will most properly do this for you. Then you need to limit the clients so they can only access public IP’s (no LAN IP’s). I guess Windows Defender Firewall needs to be involved if need security. Eg. Not only configure internet-only access on the client, but enforcing it on the server-side. If the client are kind and only wants to access internet then you can configure it with AllowedIPs
To be honest, the software was conceived for home users (I myself use it on three home PCs) and I did not think that someone would need a commercial license, because using Linux servers would be cheaper and more efficient. In any case, if the rules of your company require written permission to use the software, I think I can sign it.
Well people often use NAT because it makes things easier. As to how and where, it completely depends on the rest of your network, which can make things complicated. Particularly if you are using consumer ‘routers’ that don’t let you add static routes.
Things will work far better if you can setup routing properly though. It may seem more complex because you have to configured other things, but it will often work far better then any NAT based setup.