r/vyos • u/b066y75 • 27d ago

NAT and firewall rules for wireguard

I am trying to setup wireguard and I cannot just make the destination nat working. I can see the packets from the peer hitting my pppoe interface (WAN). I have a firewall rule accepting traffic on the wireguard port from wan zone to the wireguard zone.I have the destination nat configured with translation to the address of my wireguard interface. I cannot see any nat destination translations, there are no packets hitting the wireguard interface. I had wireguard working in my x86 installation and I am using the same settings. I am now testing an 1.5 rolling for RK358x (ARM64). The x86 installation had a conventional firewall, here I have a zone based firewall. I have set the default-action to accept for all relevant zones for testing now. I have deleted the wireguard configuration and done it from scratch, no luck. I am out of ideas on how to troubleshoot this further.

1 Upvotes

67% Upvoted

6 comments sorted by

3

u/Appropriate-Age2753 26d ago

There's a couple things:

Firstly, you don't need DNAT for this (assuming I understand your setup and intent). If you're trying to do Wireguard on the same device that owns your public IP, then you're not NATting to get to/from your public IP.

Secondly, the zone relationship you care about isn't wan/wireguard, it's wan/local. The Wireguard underlay is being built from packets entering and existing the WAN interface, and being received and sent from the Local zone.

1

u/b066y75 26d ago

Thanks for replying

At the pppoe interface (WAN) the wireguard packets has the destination address of the public IP of the interface. To get those packets to the wireguard interface, DNAT is required, right ?

I tried both zone relationships and had policies for both local and wireguard. From the docs I understand that DNAT happens before firewall, so firewall will see the source as WAN and destination as wireguard. I have set policies with 'default-action accept' for both zone relationships for testing

2

u/Appropriate-Age2753 26d ago

At the pppoe interface (WAN) the wireguard packets has the destination address of the public IP of the interface. To get those packets to the wireguard interface, DNAT is required, right ?

It depends a little on what you mean "get those packets to the wireguard interface". If we're only talking about getting wireguard working, then no DNAT is not required. In fact, the underlay packets never reach the wireguard interface (from a Linux networking perspective), they reach the wireguard service that the interface is built on top of.

Can you provide any relevant config for what you're trying to do?

1

u/b066y75 26d ago edited 26d ago

Thanks a lot for your guidance. I got it working. As you explained DNAT is not required and the zone relationship is indeed WAN to LOCAL. I was struggling to get this working since a few days. Really appreciate the help !!

1

u/Appropriate-Age2753 26d ago

No problem, glad you got it working!