On 10 September 2023 10:20 Andrei Borzenkov, wrote:
On 10.09.2023 09:45, Gijs Hillenius wrote:
> Hello,
> My server hosts several services, (web, mail), and I use firewalld.
> All of these services are defined in zone public, reachable via the
> Internet over interface eth0.
> I also want to use it as a WireGuard server.
> wg0 is the interface for zone=internal. This way, traffic from peers
> is
> masquerared fine to the Internet, because I use this policy:
> # firewall-cmd --new-policy NAT_int_to_ext --permanent
> # firewall-cmd --permanent --policy NAT_int_to_ext --add-ingress-zone internal
> # firewall-cmd --permanent --policy NAT_int_to_ext --add-egress-zone public
> # firewall-cmd --permanent --policy NAT_int_to_ext --set-target ACCEPT
> However, WireGuard peers are for now unable to reach the web and
> mail services on
> the host.
>
"The host" is meaningless on a system with multiple interfaces and IP
address. What IP address/interface your services bind to?
All of the services are at eth0
and it's all 144.76.204.189 and 2a01:4f8:200:546b::9e15:1