From 60bb89a8c30f864db719328a35b749a6d9e82d25 Mon Sep 17 00:00:00 2001
From: Sascha Moser <28950736+xopez@users.noreply.github.com>
Date: Thu, 23 Dec 2021 16:53:58 +0100
Subject: [PATCH] Include configuration for Debian Bullseye

---
 docs/guides/vpn/wireguard/internal.md | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/docs/guides/vpn/wireguard/internal.md b/docs/guides/vpn/wireguard/internal.md
index 429b8bd..4fdbd4a 100644
--- a/docs/guides/vpn/wireguard/internal.md
+++ b/docs/guides/vpn/wireguard/internal.md
@@ -44,6 +44,22 @@ PostDown = iptables -w -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w
     Substitute `eth0` in the preceding lines to match the Internet-facing interface. This may be `ens2p0` or similar on more recent Ubuntu versions (check, e.g., `ip a` for details about your local interfaces).
 <!-- markdownlint-enable code-block-style -->
 
+<!-- markdownlint-disable code-block-style -->
+!!! warning "**Important:** Debian Bullseye (Debian 11) and Raspian 11"
+    Debian Bullseye doesn't include iptables per default and uses nftables. The iptables commands can be easily implemented since the package will automatically translate and import them to nftables. First you need to install iptables:
+    ```bash
+    apt install iptables
+    ```
+
+    After that you have to set following rules for PostUP and PostDown:
+    ```bash
+    PostUp = iptables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -w -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+    PostDown = nft flush ruleset
+    ```
+
+    **Be careful with the PostDown command since it will flush all rules!** 
+<!-- markdownlint-enable code-block-style -->
+
 `PostUp` and `PostDown` defines steps to be run after the interface is turned on or off, respectively. In this case, iptables is used to set Linux IP masquerade rules to allow all the clients to share the server’s IPv4 and IPv6 address.
 The rules will then be cleared once the tunnel is down.