0

there is a problem in wireguard setup regarding to UFW.

CLIENT A   -------- SERVER -------- CLIENT B
10.10.10.5         10.10.10.1      10.10.10.11

I want to access SSH from Client A to Client B, but UFW block this with the following message.

On Server:

[UFW BLOCK] IN=wg0 OUT=wg0 MAC= SRC=10.10.10.5 DST=10.10.10.11 LEN=52 TOS=0x00 PREC=0x00 TTL=127 ID=28221 DF PROTO=TCP SPT=51201 DPT=22 WINDOW=64860 RES=0x00 SYN URGP=0

Have someone an idea which roule i have to add? On other VPN Config its recommended to change the default roule to allow. But Server is open to Internet.

Btw. Ping between clients works.

Thanks!

1 Answer 1

2

I just got done troubleshooting this problem on my own setup. The issue was that somehow I lost my iptables settings which allowed masquerading wireguard traffic on my wireguard host. Here's the appropriate command (substitude wg0 for your wireguard device, and ens3 for your lan device):

iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ens3 -j MASQUERADE

After that I was able to ssh properly again! You can add these to your wireguard config files to automate iptables by adding these lines to your wireguard config on the server host under [Interface]:

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ens3 -j MASQUERADE

Source: https://securityespresso.org/tutorials/2019/03/22/vpn-server-using-wireguard-on-ubuntu#configuration and far too much time spent on wireguard troubleshooting :)

3
  • This doesn't appear to address the topic of the question at all.
    – womble
    Oct 3, 2019 at 1:44
  • @womble OPs description of the problem perfectly matches the problem I was having, so I told him how I solved said problem. Maybe I’m mistaken, but how did I not address the topic at hand?
    – Chase
    Oct 3, 2019 at 5:12
  • @womble it answers the question. Problem is/was that clients could not communicate with each other through the server (had the same problem). Unless you allow FORWARD directive in iptables. So the answer is correct. The FORWARD directive is enough though. If you don't need inet access from the vpn out, the POSTROUTING directive is not required.
    – insider
    Jan 6, 2020 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .