angristan / angristan/wireguard-install

iptables rules based on port - multiple LAN interfaces on server

Ouverte
#508 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
Shell
Étoiles
11.3k
Forks
1.7k
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

I have a server that has wan0 and lan0.
- ubuntu 22.04
- eth0 is public ip like 55.55.55.55
- lan0 is 10.50.50.0/24
- wireguard is configured as 10.51.51.0/24

By default using this install script I can connect to wireguard on the servers public ip (eth0)
- I can ping wireguard interface on server 10.51.51.1 but not any of the "lan" in 10.50.50.0/24 subnet
- This is because the iptable rules are more specific to bring in/out traffic on eth0 and ignores lan0

A workaround is iptables based on what ever the wireguard server port is running on allows wireguard clients to utilize eth0 public or eth1 private subnets without specifying the lan private range. Example if I had 4 interfaces on the server and each one had a different subnet for different vlans etc then the following iptable rules would work for all interfaces/subnets based on $port for wireguard server. In this case here I am using port 52688 (yes non standard). Thanks!

`PostUp = iptables -t nat -A POSTROUTING -s 10.51.51.0/24 ! -d 10.51.51.0/24 -j MASQUERADE`
`PostUp = iptables -I INPUT -p udp --dport 52688 -j ACCEPT`
`PostUp = iptables -I FORWARD -s 10.51.51.0/24 -j ACCEPT`
`PostUp = iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT`
`PostDown = iptables -t nat -D POSTROUTING -s 10.51.51.0/24 ! -d 10.51.51.0/24 -j MASQUERADE`
`PostDown = iptables -D INPUT -p udp --dport 52688 -j ACCEPT`
`PostDown = iptables -D FORWARD -s 10.51.51.0/24 -j ACCEPT`
`PostDown = iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT`

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.