Comments (4)
The curly brackets are not correct
OPEN_TCP="{ens3,wg0}#22 ...
I would not use OPEN_TCP / OPEN_UDP
for the wireguard interfaces, but rather NAT_FORWARD_TCP / NAT_FORWARD_UDP
to reach the NAT_INTERNAL_NET
from the external interface.
from aif.
Thank you. I tried NAT_FORWARD_TCP last weekend and yesterday, but somehow I am mentally stuck.
The machine is a single machine in a data center. It has four interfaces: lo, eth0, wg0, wg1
My problem: What is INTERNAL_NET in this case? I tried 127.0.0.1and I had the impression, that this net is special.
At least manual the tests with the wireguard client of my telephone did not succeed, but I might have messed up.
Is 127.0.0.1 a good choice?
Do I have to set:
# (EXPERT SETTING!) Enable this if you want to be able to redirect local ports
# or protocols on your gateway using NAT forwards.
# ------------------------------------------------------------------------------
NAT_LOCAL_REDIRECT=0
If I want to allow access from the external interface wg0 to the port 22 of the internal net? What exactly is a local port? I have some services listening to all interfaces like ssh. It is listening on 0.0.0.0:22
from aif.
The machine is a single machine in a data center. It has four interfaces: lo, eth0, wg0, wg1
Given that info, try something like:
EXT_IF="eth0"
EXT_IF_DHCP_IP=1
INT_IF="wg0 wg1"
INTERNAL_NET="10.0.0.0/24 10.0.1.0/24"
(Optional) Only if Wireguard traffic needs to go outbound, outside of tunnel:
NAT=1
NAT_INTERNAL_NET="10.0.0.0/24 10.0.1.0/24"
Then to allow inbound Wireguard to wg0 (ex. port 51820)
Note: Adjust 0/0
to a more restrictive range if desired.
HOST_OPEN_UDP="0/0~51820"
This should allow you to use an external Wireguard peer to connect to your Wireguard instance and SSH over the tunnel.
Try little steps at a time.
from aif.
Hi,
I experimented a bit more and did not achieve the level of separation I want.
Basically ports are reachable on the internal_net, where I do not expect them.
If I scan from my laptop the internal address 10.0.1.1 interface wg1 of the server I see:
nmap -p 22-9000 10.0.1.1
Starting Nmap 7.93 ( https://nmap.org ) at 2024-04-01 21:42 CEST
Nmap scan report for 10.0.1.1
Host is up (0.029s latency).
PORT STATE SERVICE
22/tcp open ssh
8443/tcp open https-alt
8444/tcp open pcsync-http
8446/tcp open unknown
8447/tcp open unknown
8448/tcp open unknown
8449/tcp open unknown
I have currently this configured wrt to wg1 and ssh:
OPEN_TCP="ens3,wg0#22 ens3,wg0#53 ens3#8443 ens3#8444:8449"
INT_IF="wg0 wg1"
INTERNAL_NET="10.0.0.0/24 10.0.1.0/24"
I did an iptables-save -f /tmp/xx of the iptables config and:
# rg 22 /tmp/xx
126:-A EXT_INPUT_CHAIN -i ens3 -p tcp -m tcp --dport 22 -j ACCEPT
127:-A EXT_INPUT_CHAIN -i wg0 -p tcp -m tcp --dport 22 -j ACCEPT
140:-A EXT_INPUT_CHAIN -d 224.0.0.0/4 -j EXT_MULTICAST_CHAIN
I thought port 22 would be open on ens3 and wg0, but not on wg1.
from aif.
Related Issues (20)
- Error: either "to" is duplicate, or "equalize" is garbage HOT 5
- Plugin loopback_nat not loading properly? HOT 1
- Missing support for docker HOT 3
- support for AnyIP? HOT 1
- No iptables/ip6tables found at Debian 10 (2021/03/26) HOT 8
- IPSET/NETSET support in HOST_OPEN_TCP HOT 2
- aif 2.03 doesn't start on debian buster HOT 5
- Ubuntu 22.04 with libvirtd, the bridge interface 'virbr0' does not start automatically HOT 3
- AIF falling back to conntrack legacy automatic helper in Debian with kernel 6.0 and higher HOT 5
- nftables as aif backend HOT 1
- Disable "Dropped INPUT packet" logging? HOT 5
- AIF blocking nimble HOT 2
- Pings on the internal network to the firewall server are being blocked. HOT 5
- # Warning: iptables-legacy tables present, use iptables-legacy-save to see them HOT 1
- One "catch all" LOGging is still in effect after disabling ALL LOGs in the config HOT 2
- Manpages still mention Arno's previous email address
- multiroute multiple ISP, individual snat and multiple routing tables HOT 1
- Proxmox unprivileged container problem
- AIF - Feature request - chain load other script/command HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aif.