On 10 September 2023 21:38 Andrei Borzenkov, wrote:
On 10.09.2023 19:10, Gijs Hillenius wrote:
> On 10 September 2023 17:35 Andrei Borzenkov, wrote:
>
>> On 10.09.2023 11:49, Gijs Hillenius wrote:
>>> On 10 September 2023 10:20 Andrei Borzenkov, wrote:
>>>
>>>> On 10.09.2023 09:45, Gijs Hillenius wrote:
>>>>> Hello,
>>>>> My server hosts several services, (web, mail), and I use firewalld.
>>>>> All of these services are defined in zone public, reachable via the
>>>>> Internet over interface eth0.
>>>>> I also want to use it as a WireGuard server.
>>>>> wg0 is the interface for zone=internal. This way, traffic from peers
>>>>> is
>>>>> masquerared fine to the Internet, because I use this policy:
>>>>> # firewall-cmd --new-policy NAT_int_to_ext --permanent
>>>>> # firewall-cmd --permanent --policy NAT_int_to_ext --add-ingress-zone
internal
>>>>> # firewall-cmd --permanent --policy NAT_int_to_ext --add-egress-zone
public
>>>>> # firewall-cmd --permanent --policy NAT_int_to_ext --set-target
ACCEPT
>>>>> However, WireGuard peers are for now unable to reach the web and
>>>>> mail services on
>>>>> the host.
>>>>>
>>>>
>>>> "The host" is meaningless on a system with multiple interfaces
and IP
>>>> address. What IP address/interface your services bind to?
>>> All of the services are at eth0
>>> and it's all 144.76.204.189 and 2a01:4f8:200:546b::9e15:1
>>>
>>
>> This can be problematic even without any firewall involved. Reply to
>> packets entering via wg0 may be sent via eth0 depending on the routing
>> table. Does it work if you stop firewalld on this server?
> I have not tried that (yet).
> The set-up used to work just fine with firewalld 0.9.3 (in Debian
> 11). It stopped
> working when I moved the server to firewalld 1.3.0 (in Debian 12).
> But in that earlier set-up, I didn't have a zone internal.
So you likely just need to open the same ports in the zone assigned to wg0.
ACK. That works.
Thank you.