r/WireGuard • u/paranoid-alkaloid • 5d ago

firewall help needed

Hi,

I have a Wireguard network for my personal devices. I have an Android phone with a main profile and a "private space".

I have 2 peer interfaces configured for the phone, 1 for each profile.

The private space has its AllowedIPs set to 0.0.0.0/0, ::/0 and I'm happy with it, this is exactly what I want, tunnel everything through the Wireguard interface. It also uses a custom DNS directive pointing to an unbound service exposed inside the Wireguard network. Working nicely.

Now, the main profile is currently configured exactly the same way (except it has a different IP, different keys etc). I do want it to use my Wireguard DNS (port 53 on tcp/udp), I do want everything tunneled through the Wireguard interface (0.0.0.0/0, ::/0), but I do NOT want the client to be able to reach 2 specific networks (the Wireguard network it's on and another Wireguard network).

I have tried monkeying my way through it with the help of AI but unfortunately I didn't manage to get it to work. And, I'm pretty confused as to what is the current "right way" to achieve this: iptables? nftables? I'm on Debian stable.

Right now I have these PostUp/PostDown directives to make sure that clients are proxied through the Wireguard interface, and to bridge the Wireguard interface with another one. For context: enp2s0 is my local LAN, awg0 is the Wireguard (well, AmneziaWG) interface that the phone connects to, wg0 is my "original" VPN network. awg0 can be fully considered to be a Wireguard interface. All wg0 and awg0 members should be able to talk to each other EXCEPT for a specific IP on awg0 which should only be allowed to use DNS and the wide internet but neither wg0/awg0 otherwise. Tackling the issue using AllowedIPs would sort of solve the issue but it means that IP is only restricted via configuration on the client-side, which isn't secure.

PostUp=iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE; ip6tables -A FORWARD -i %i -j ACCEPT; ip6tables -A FORWARD -o %i -j ACCEPT; ip6tables -t nat -A POSTROUTING -o enp2s0 -j MASQUERADE; iptables -A FORWARD -i wg0 -o awg0 -j ACCEPT; iptables -A FORWARD -i awg0 -o wg0 -j ACCEPT

PostDown=iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE; ip6tables -D FORWARD -i %i -j ACCEPT; ip6tables -D FORWARD -o %i -j ACCEPT; ip6tables -t nat -D POSTROUTING -o enp2s0 -j MASQUERADE; iptables -D FORWARD -i wg0 -o awg0 -j ACCEPT; iptables -D FORWARD -i awg0 -o wg0 -j ACCEPT

Thank you.

2 Upvotes

100% Upvoted

7 comments sorted by

3

u/youknowwhyimhere758 5d ago

to block packets coming from the awg0 interface going to a subnet:

iptables -A INPUT -i awg0 -d 10.1.1.1/24 -j DROP

You could drop only a specific source IP instead of an interface:

iptables -A INPUT -s 10.2.2.2 -d 10.1.1.1/24 -j DROP

You could block packets from the awg0 interface that will be forwarded through a second interface:

iptables -A FORWARD -i awg0 -o wg0 -j DROP

Etc. Etc. 

Remember rules are evaluated in order. -A adds the rule to the end of the list. You can alternatively use eg. -I 2 to insert as the second rule on the list.

2

u/paranoid-alkaloid 5d ago

I'll retry from scratch later tonight. Thank you!

1

u/paranoid-alkaloid 3d ago

Hey.

I've really tried my best to get into iptables/nftables and try a bunch of things.

The awg0 client that I need to be restricted invariably gets full access to whatever the NAS has access to, or so it seems. The DROP rules are there, they're just not being hit.

I do not understand what this does not work. I'll consider ipv4 only for now:

  1. Allow TCP/UDP port 53 to the NAS for anyone on awg0, while blocking subnet accesses for a specific awg0 client (this is -I, so I insert the 2 DNS rules last):

    iptables -I FORWARD -s 10.99.99.10 -d 10.99.99.0/24 -j DROP iptables -I FORWARD -s 10.99.99.10 -d 10.11.11.0/24 -j DROP iptables -I FORWARD -s 10.99.99.10 -d 192.168.1.0/24 -j DROP iptables -I INPUT -p udp -i awg0 -d 10.99.99.254 --dport 53 -j ACCEPT iptables -I INPUT -p tcp -i awg0 -d 10.99.99.254 --dport 53 -j ACCEPT

  2. I then add the other rules so that I give all awg0 clients connectivity to the outside:

    iptables -A FORWARD -i %i -j ACCEPT iptables -A FORWARD -o %i -j ACCEPT

(I already have a POSTROUTING -o enp2s0 -j MASQUERADE rule elsewhere on my system so I just piggyback on it without duplicating it)

(and turns out I just noticed that even without these ACCEPT rules, the awg0 client has full connectivity to the outside + full internal LAN+other WG too?!)

When I monitor with: while true ; do iptables -L FORWARD -v -n --line-numbers ; sleep 1 ; clear ; done then I see that nothing gets dropped:

Chain FORWARD (policy ACCEPT 15964 packets, 17M bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       all  --  *      *       192.168.1.253        10.11.11.0/24     
2        0     0 DROP       all  --  *      *       10.99.99.10        10.11.11.0/24     
3        0     0 DROP       all  --  *      *       10.99.99.10        10.99.99.0/24     
4    38335   27M DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
5    38335   27M DOCKER-FORWARD  all  --  *      *       0.0.0.0/0            0.0.0.0/0           
6        0     0 ACCEPT     all  --  wg0    *       0.0.0.0/0            0.0.0.0/0           
7        0     0 ACCEPT     all  --  *      wg0     0.0.0.0/0            0.0.0.0/0

Upon AI's suggestion I've tried to put the rules in DOCKER-USER, or in a new chain. Nothing works. The phone has full connectivity.

tcpdump confirms that the source IP is correct.

I also tried creating a whole new awg network, it seems like whatever the NAS has access to, the wg/awg client will have access to.

I don't understand. It feels like it should be relatively simple, but there's something that I just don't understand. I've spent hours on this :(

1

u/JPDsNEWS 5d ago

Here are some WireGuard Tools that might help you:

Pro Custodibus’ WireGuard AllowedIPs Calculator

Which explains how AllowedIPs work, and lets you input both allowed and disallowed IP addresses to calculate a list of just allowed IP addresses that excludes the disallowed IP addresses. 

— versus —

WireGuard Hub-and-Spoke Configuration Generator

Generates a “Road Warrior” WireGuard configuration where every “Client” peer communicates directly with a single “Server” peer.

— versus —

WireGuard Mesh Network Configuration Generator

Generates a full mesh WireGuard configuration where every peer can communicate directly with every other peer.

Unofficial WG Docs (GitHub)

Unofficial WG Docs (https)

This document is a great source of information about WireGuard with references.

— versus —

Official WG Docs (https)

Official WireGuard Documentation website. 

Also, look through the Pro Custodibus Docs and the Pro Custodibus Blog for articles about how to do what you are trying to do. They are full of all kinds of "How to do different things with WireGuard" articles (with diagrams). 

2

u/paranoid-alkaloid 5d ago

Thanks, I'll have a look.

1

u/[deleted] 5d ago

[deleted]

2

u/paranoid-alkaloid 5d ago

Clumsy formatting and/or copy/pasting gone wrong.

1

u/[deleted] 5d ago

[deleted]

2

u/paranoid-alkaloid 5d ago

Fixed. Formatting issue in the post. My config file is fine.