Hi everyone,
I’ve had Wireguard configured and working fine on VyOS 1.3.
However I’ve migrated to 1.4 and I’m still learning nftables rules and chaining.
While following the documentation seems to not have been updated regarding the firewall rules, since it still mentions IPTables concepts, specifically:
set firewall ipv4 name OUTSIDE_LOCAL rule 10 action accept
set firewall ipv4 name OUTSIDE_LOCAL rule 10 description 'Allow established/related'
set firewall ipv4 name OUTSIDE_LOCAL rule 10 state established enable
set firewall ipv4 name OUTSIDE_LOCAL rule 10 state related enable
set firewall ipv4 name OUTSIDE_LOCAL rule 20 action accept
set firewall ipv4 name OUTSIDE_LOCAL rule 20 description WireGuard_IN
set firewall ipv4 name OUTSIDE_LOCAL rule 20 destination port 51820
set firewall ipv4 name OUTSIDE_LOCAL rule 20 log enable
set firewall ipv4 name OUTSIDE_LOCAL rule 20 protocol udp
set firewall ipv4 name OUTSIDE_LOCAL rule 20 source
set interfaces ethernet eth0 firewall local name 'OUTSIDE-LOCAL'
https://docs.vyos.io/en/sagitta/configuration/interfaces/wireguard.html#firewall-exceptions
This config path technically doesn’t exist in 1.4, as such I’m looking if you can assist me in understanding what I might be missing on my configuration.
I’m only using IPv4 (I’m dropping IPv6 packets and set anything ipv6 as disabled in the global options).
My firewall configuration is mostly the quick started guide.
ipv4 {
forward {
filter {
rule 10 {
action jump
jump-target CONN_FILTER
}
rule 100 {
action jump
destination {
group {
network-group NET-INSIDE
}
}
inbound-interface {
group WAN
}
jump-target OUTSIDE-IN
}
}
}
input {
filter {
default-action drop
rule 10 {
action jump
jump-target CONN_FILTER
}
rule 15 {
action jump
inbound-interface {
group WAN
}
jump-target WAN-IN-INPUT
}
}
}
name CONN_FILTER {
default-action return
rule 10 {
action accept
state established
state related
}
rule 20 {
action drop
state invalid
}
}
name OUTSIDE-IN {
default-action drop
}
name WAN-IN-INPUT {
default-action drop
rule 100 {
action accept
description "Wireguard WG01"
destination {
port <My_wireguard_port>
}
log
protocol udp
}
}
Then I have a NAT Source Masquerade rule:
source {
rule 100 {
outbound-interface {
group WAN
}
source {
group {
network-group NET-INSIDE
}
}
translation {
address masquerade
}
}
rule 200 {
outbound-interface {
group WAN
}
source {
group {
network-group WIREGUARD
}
}
translation {
address masquerade
}
}
}
Under operation mode, when I run show interfaces wireguard detail I only have a few dropped packets, which I assumed was due to me enabling persistent-keepalive 15 on the server (VyOS) to test.
wg01: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1400 qdisc noqueue state UNKNOWN group default qlen 1000
link/none
inet 172.16.10.1/24 brd 172.16.10.255 scope global wg01
valid_lft forever preferred_lft forever
inet6 fe80::fd4c:baff:feba:b8c6/64 scope link
valid_lft forever preferred_lft forever
Description: Wireguard Home Personal
RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collisions
0 0 0 3 0 0
Doing show log firewall name WAN-IN-INPUT rule 100 I get nothing.
Considering that Wireguard is running on VyOS, I assumed that the traffic would be considered as “input”, is this correct?
I also assumed that “forward” traffic coming from WAN, will only happen for connections that suffer NAT, which in my case I don’t have any destination NAT rules as I didn’t need them to have Wireguard work in 1.3.
Any ideas what I’m I missing?
Thanks.
