On 10.09.2023 19:10, Gijs Hillenius wrote:
On 10 September 2023 17:35 Andrei Borzenkov, wrote:
> On 10.09.2023 11:49, Gijs Hillenius wrote:
>> On 10 September 2023 10:20 Andrei Borzenkov, wrote:
>>
>>> On 10.09.2023 09:45, Gijs Hillenius wrote:
>>>> Hello,
>>>> My server hosts several services, (web, mail), and I use firewalld.
>>>> All of these services are defined in zone public, reachable via the
>>>> Internet over interface eth0.
>>>> I also want to use it as a WireGuard server.
>>>> wg0 is the interface for zone=internal. This way, traffic from peers
>>>> is
>>>> masquerared fine to the Internet, because I use this policy:
>>>> # firewall-cmd --new-policy NAT_int_to_ext --permanent
>>>> # firewall-cmd --permanent --policy NAT_int_to_ext --add-ingress-zone
internal
>>>> # firewall-cmd --permanent --policy NAT_int_to_ext --add-egress-zone
public
>>>> # firewall-cmd --permanent --policy NAT_int_to_ext --set-target ACCEPT
>>>> However, WireGuard peers are for now unable to reach the web and
>>>> mail services on
>>>> the host.
>>>>
>>>
>>> "The host" is meaningless on a system with multiple interfaces and
IP
>>> address. What IP address/interface your services bind to?
>> All of the services are at eth0
>> and it's all 144.76.204.189 and 2a01:4f8:200:546b::9e15:1
>>
>
> This can be problematic even without any firewall involved. Reply to
> packets entering via wg0 may be sent via eth0 depending on the routing
> table. Does it work if you stop firewalld on this server?
I have not tried that (yet).
The set-up used to work just fine with firewalld 0.9.3 (in Debian 11). It stopped
working when I moved the server to firewalld 1.3.0 (in Debian 12).
But in that earlier set-up, I didn't have a zone internal.
So you likely just need to open the same ports in the zone assigned to wg0.