On 10 September 2023 17:35 Andrei Borzenkov, wrote:
On 10.09.2023 11:49, Gijs Hillenius wrote:
> On 10 September 2023 10:20 Andrei Borzenkov, wrote:
>
>> On 10.09.2023 09:45, Gijs Hillenius wrote:
>>> Hello,
>>> My server hosts several services, (web, mail), and I use firewalld.
>>> All of these services are defined in zone public, reachable via the
>>> Internet over interface eth0.
>>> I also want to use it as a WireGuard server.
>>> wg0 is the interface for zone=internal. This way, traffic from peers
>>> is
>>> masquerared fine to the Internet, because I use this policy:
>>> # firewall-cmd --new-policy NAT_int_to_ext --permanent
>>> # firewall-cmd --permanent --policy NAT_int_to_ext --add-ingress-zone
internal
>>> # firewall-cmd --permanent --policy NAT_int_to_ext --add-egress-zone public
>>> # firewall-cmd --permanent --policy NAT_int_to_ext --set-target ACCEPT
>>> However, WireGuard peers are for now unable to reach the web and
>>> mail services on
>>> the host.
>>>
>>
>> "The host" is meaningless on a system with multiple interfaces and IP
>> address. What IP address/interface your services bind to?
> All of the services are at eth0
> and it's all 144.76.204.189 and 2a01:4f8:200:546b::9e15:1
>
This can be problematic even without any firewall involved. Reply to
packets entering via wg0 may be sent via eth0 depending on the routing
table. Does it work if you stop firewalld on this server?
I have not tried that (yet).
The set-up used to work just fine with firewalld 0.9.3 (in Debian 11). It stopped
working when I moved the server to firewalld 1.3.0 (in Debian 12).
But in that earlier set-up, I didn't have a zone internal.