On Mon, Feb 04, 2019 at 10:58:31PM -0800, Larry Gadallah wrote:
> Hi all:
> Does anyone know how to accomplish the equivalent of the Linux:
> PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACC
> EPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
> PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j A
> CCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
> in the OpenBSD pf dialect? Does this trick even work for the
> user-space Wireguard implementation?
Not really knowing iptables I would think you want somthing like:
pass in on wg0
pass out on eth0 received-on wg0 nat-to (eth0)
Guess wg0 would be more like tun0 and eth0 could be egress so
pass in on tun0
pass out on egress received-on tun0 nat-to (egress)
On Tue, Feb 05, 2019 at 08:20:20AM +0100, Claudio Jeker wrote:
> Not really knowing iptables I would think you want somthing like:
> pass in on wg0
> pass out on eth0 received-on wg0 nat-to (eth0)
> Guess wg0 would be more like tun0 and eth0 could be egress so
> pass in on tun0
> pass out on egress received-on tun0 nat-to (egress)
I was going to write much what Claudio said here but also (after looking
it up in the iptables man page on a nearby system) it looks like your
application needs to insert and delete rules in a running rule set,
so you might consider inserting somewhere in the basic setup for your
application that you set up an anchor in the system's pf.conf where
it can do just that.
On Tue, Feb 05, 2019 at 07:40:30AM +0000, Tom Smyth wrote:
> >From looking at your config it looks like when the wiregusrd interface
> comes up
> You want to allow forward traffic
> And you want masqurade traffic leaving on eth0
> 1)You dont really need to add and remove those rules as the wireguard
> tunnel comes up id suggest just adding firewall rules statically
I'm sort of clueless about the application, but I agree that it may not
be worth the bother to insert and remove rules dynamically in most cases.
If you really need to do that dance, ftp-proxy (shudder) is a prime example
of one that does.
> 5) to learn more about pf config check out Peter Hansteen's pf tutorial and
> his book of pf and man pf.conf for more details
Thanks for the recommendations :)
Direct links at the end
All the best,
> > in the OpenBSD pf dialect?
I was going to ignore that but really: OpenBSD is the upstream for everyone
else for PF and lots of other stuff (see eg), so if there are such things
as "dialect"s in play, they come from somewhere else.