Hello,
My server hosts several services, (web, mail), and I use firewalld.
All of these services are defined in zone public, reachable via the
Internet over interface eth0.
I also want to use it as a WireGuard server.
wg0 is the interface for zone=internal. This way, traffic from peers is
masquerared fine to the Internet, because I use this policy:
# firewall-cmd --new-policy NAT_int_to_ext --permanent
# firewall-cmd --permanent --policy NAT_int_to_ext --add-ingress-zone internal
# firewall-cmd --permanent --policy NAT_int_to_ext --add-egress-zone public
# firewall-cmd --permanent --policy NAT_int_to_ext --set-target ACCEPT
However, WireGuard peers are for now unable to reach the web and mail services on
the host.
I've studied the firewalld website documentation, searched the mailing
list, and perused other sources. Not entirely confident ... I would like
confirmation that this is what is needed:
1) allow wg0 (internal) --> eth1 (public) <<< done
2) allow eth1 (public) --> wg0 (internal)
And for that second step, that could be something like this - copied
from the firewalld blog "Policy Objects: Introduction":
# firewall-cmd --permanent --new-policy myOutputPolicy
# firewall-cmd --permanent --policy myOutputPolicy --add-ingress-zone HOST
# firewall-cmd --permanent --policy myOutputPolicy --add-egress-zone ANY
In addition, I have a doubt about my initial configuration of wireguard
to use port 51820 on the zone public.
If I run "firewall-cmd --zone=public --list-all" it will show (among
other)
ports: 51820/udp
the same command for zone internal won't show that port.
I wonder if I needed to add that port to zone=public. I think it is only
for zone internal? And there it works without needing explicit
assignment?
Kind greetings
Gijs
