SOLUTION: Double-check your NAT to ensure you’re not redirecting ALL traffic to the wrong device …
To start, I am running 1.3.4 getting ready to update to 1.3.6 to see if the issue resolves, but wanted to get a head start on this since it’s driving me crazy.
I have been having issues with the LOCAL zone-based firewall rules for what I believe to be quite some time now. Initially I thought it was with Wireguard as it is where I would notice the problem first when I would make a configuration change to switch between my Primary and Backup ISPs, however upon further testing I’ve noticed the following:
- tcpdump confirms the firewall is seeing WAN traffic hitting on port 51820 from mobile device.
- Confirmed Wireguard configuration is indeed correct as if I temporarily disable the firewall by flushing nftables, I am able to connect from WAN2LOCAL and ping/ssh without issue.
- Double-confirmed Wireguard configuration is indeed correct as I am able to connect via NAT inside the LAB.
- Confirmed firewall does not appear to be working AT ALL for the WAN2LOCAL zone via a TCP port-checker and the inability to ping the WAN static address despite having rules in place allowing for both conditions. (The TCP port-checker test rule has since been removed).
I am at a complete loss here. I followed Kroy’s VyOS from Scratch Part 1 blog entry then customized from there, but recall time after time again what appears to be the most innocent of changes (such as adding a new firewall rule) causes some completely unrelated portion to break. Am I crazy and messed something up in the config, or is there something more going on here???
show config | strip-private:
firewall {
all-ping enable
broadcast-ping disable
config-trap disable
group {
port-group 3CX {
port 5060
port 5090
port 9000-9398
port 10600-10998
port 5001
}
port-group http {
port 443
port 8443
port 80
port 8080
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
name LAN2LOCAL {
default-action accept
}
name LAN2WAN {
default-action accept
}
name LOCAL2LAN {
default-action accept
}
name LOCAL2WAN {
default-action accept
}
name WAN2LAN {
default-action drop
rule 1 {
action accept
description "Allow est/related traffic"
log enable
state {
established enable
related enable
}
}
rule 2 {
action accept
log enable
protocol icmp
state {
new enable
}
}
rule 10 {
action accept
destination {
address xxx.xxx.21.2/32
group {
port-group 3CX
}
}
protocol tcp_udp
state {
new enable
}
}
rule 100 {
action accept
description "Allow HTTP(s) traffic to all Exposed Services"
destination {
address xxx.xxx.21.0/29
group {
port-group http
}
}
protocol tcp_udp
state {
new enable
}
}
rule 101 {
action accept
description "Allow Minecraft traffic"
destination {
address xxx.xxx.30.2
port 25565
}
protocol tcp_udp
state {
new enable
}
}
}
name WAN2LOCAL {
default-action drop
rule 1 {
action accept
description "Allow est/related traffic"
log enable
state {
established enable
related enable
}
}
rule 2 {
action accept
log enable
protocol icmp
state {
new enable
}
}
rule 3 {
action accept
description "Allow WireGuard traffic"
destination {
port 51820
}
log enable
protocol udp
state {
new enable
}
}
}
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}
interfaces {
bonding bond0 {
description "Routing Backbone"
hash-policy layer2+3
member {
interface eth2
interface eth3
}
mode 802.3ad
vif 10 {
address xxx.xxx.10.1/24
description "Physical Infrastructure"
}
vif 11 {
address xxx.xxx.11.1/24
description "Virtual Infrastructure"
}
vif 20 {
address xxx.xxx.20.1/24
description "Hosted Services"
}
vif 21 {
address xxx.xxx.21.1/29
description "Exposed Services"
}
vif 30 {
address xxx.xxx.30.1/24
description "Trusted Devices"
}
vif 31 {
address xxx.xxx.31.1/24
description "Untrusted Devices"
}
vif 32 {
address xxx.xxx.32.1/24
description "Guest Devices"
}
vif 200 {
address xxx.xxx.200.1/24
description "Testing LAN"
}
}
ethernet eth0 {
address xxx.xxx.182.76/24
address xxx.xxx.182.77/24
address xxx.xxx.182.78/24
address xxx.xxx.182.79/24
address xxx.xxx.182.80/24
description Frontier
hw-id xx:xx:xx:xx:xx:fa
}
ethernet eth1 {
address dhcp
description Spectrum
hw-id xx:xx:xx:xx:xx:fb
}
ethernet eth2 {
hw-id xx:xx:xx:xx:xx:71
}
ethernet eth3 {
hw-id xx:xx:xx:xx:xx:72
}
ethernet eth4 {
hw-id xx:xx:xx:xx:xx:74
}
loopback lo {
}
wireguard wg0 {
address xxx.xxx.222.1/24
address xxx.xxx.57.1/24
description "Remote Access"
peer RNET-R913510T {
allowed-ips xxx.xxx.57.2/32
preshared-key ****************
pubkey ****************
}
peer grmedia {
allowed-ips xxx.xxx.57.3/32
pubkey ****************
}
port 51820
}
}
nat {
destination {
rule 1 {
description 3CX
destination {
address xxx.xxx.182.77
}
inbound-interface eth0
translation {
address xxx.xxx.21.2
}
}
rule 2 {
destination {
address xxx.xxx.182.78
}
inbound-interface eth0
translation {
address xxx.xxx.21.3
}
}
rule 3 {
destination {
address xxx.xxx.182.79
}
inbound-interface eth0
translation {
address xxx.xxx.21.4
}
}
rule 4 {
destination {
address xxx.xxx.182.80
}
inbound-interface eth0
translation {
address xxx.xxx.21.5
}
}
rule 100 {
description "Allow Minecraft traffic"
destination {
address xxx.xxx.182.76
}
inbound-interface eth0
translation {
address xxx.xxx.30.2
}
}
}
source {
rule 1 {
description 3CX
outbound-interface eth0
source {
address xxx.xxx.21.2
}
translation {
address xxx.xxx.182.77
}
}
rule 2 {
outbound-interface eth0
source {
address xxx.xxx.21.3
}
translation {
address xxx.xxx.182.78
}
}
rule 3 {
outbound-interface eth0
source {
address xxx.xxx.21.4
}
translation {
address xxx.xxx.182.79
}
}
rule 4 {
outbound-interface eth0
source {
address xxx.xxx.21.5
}
translation {
address xxx.xxx.182.80
}
}
rule 20 {
outbound-interface eth0
source {
address xxx.xxx.0.0/16
}
translation {
address masquerade
}
}
rule 21 {
outbound-interface eth0
source {
address xxx.xxx.57.0/24
}
translation {
address masquerade
}
}
}
}
protocols {
static {
interface-route xxx.xxx.57.0/24 {
next-hop-interface wg0 {
disable
}
}
route xxx.xxx.0.0/0 {
next-hop xxx.xxx.182.1 {
}
}
}
}
service {
dhcp-server {
shared-network-name xxxxxx {
authoritative
description "Guest Devices"
domain-search xxxxxx
name-server xxx.xxx.20.2
name-server xxx.xxx.20.3
ntp-server xxx.xxx.20.4
ping-check
subnet xxx.xxx.32.0/24 {
default-router xxx.xxx.32.1
range 0 {
start xxx.xxx.32.2
stop xxx.xxx.32.254
}
}
}
shared-network-name xxxxxx {
authoritative
description "Trusted Devices"
domain-search xxxxxx
name-server xxx.xxx.20.2
name-server xxx.xxx.20.3
ntp-server xxx.xxx.20.4
ping-check
subnet xxx.xxx.200.0/24 {
default-router xxx.xxx.200.1
range 0 {
start xxx.xxx.200.50
stop xxx.xxx.200.254
}
}
}
shared-network-name xxxxxx {
authoritative
description "Trusted Devices"
domain-search xxxxxx
name-server xxx.xxx.20.2
name-server xxx.xxx.20.3
ntp-server xxx.xxx.20.4
ping-check
subnet xxx.xxx.30.0/24 {
default-router xxx.xxx.30.1
range 0 {
start xxx.xxx.30.50
stop xxx.xxx.30.254
}
}
}
shared-network-name xxxxxx {
authoritative
description "Untrusted Devices"
domain-search xxxxxx
name-server xxx.xxx.20.2
name-server xxx.xxx.20.3
ntp-server xxx.xxx.20.4
ping-check
subnet xxx.xxx.31.0/24 {
default-router xxx.xxx.31.1
range 0 {
start xxx.xxx.31.50
stop xxx.xxx.31.254
}
}
}
}
dns {
dynamic {
interface eth1 {
service cloudflare {
host-name xxxxxx
login [email protected]
password xxxxxx
protocol cloudflare
zone reinitialized.net
}
}
}
}
ssh {
listen-address xxx.xxx.0.0
port 22
}
}
system {
config-management {
commit-revisions 100
}
conntrack {
modules {
ftp
h323
nfs
pptp
sip
sqlnet
tftp
}
}
console {
device ttyS0 {
speed 115200
}
}
domain-name xxxxxx
host-name xxxxxx
login {
user xxxxxx {
authentication {
encrypted-password xxxxxx
}
}
}
name-server xxx.xxx.20.2
name-server xxx.xxx.20.3
ntp {
server xxxxx.tld {
}
}
option {
performance latency
}
syslog {
global {
facility all {
level info
}
facility protocols {
level debug
}
}
}
time-zone US/Central
}
zone-policy {
zone LAN {
default-action drop
from LOCAL {
firewall {
name LOCAL2LAN
}
}
from WAN {
firewall {
name WAN2LAN
}
}
interface bond0.10
interface bond0.11
interface bond0.20
interface bond0.21
interface bond0.30
interface bond0.31
interface bond0.32
interface bond0.200
}
zone LOCAL {
default-action drop
from LAN {
firewall {
name LAN2LOCAL
}
}
from WAN {
firewall {
name WAN2LOCAL
}
}
local-zone
}
zone WAN {
default-action drop
from LAN {
firewall {
name LAN2WAN
}
}
from LOCAL {
firewall {
name LOCAL2WAN
}
}
interface eth1
interface eth0
}
}
