Hi,
I have setup a wireguard connection between my laptop (Fedora 39) and an
Almalinux 9 x86_64 server which also runs a knot DNS resolver on port 53
(IPv4 & IPv6) to be used by the laptop when the wireguard connection is
active. This all works fine but it requires:
/etc/firewalld/firewalld.conf
FirewallBackend=iptables
and these firewall-cmd rules in the server's wireguard wg0 config:
(this is one long line but separated for clarity)
PostUp =
firewall-cmd --zone=public --add-port=443/udp;
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s
192.168.2.0/24 -o eth0 -j MASQUERADE;
firewall-cmd --direct --add-rule ipv4 filter INPUT 0 -i %i -j ACCEPT;
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i %i -o eth0 -j
ACCEPT;
firewall-cmd --direct --add-rule ipv4 filter FORWARD 0 -i eth0 -o %i -j
ACCEPT;
firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s
fdcc:xxxx:xxxx::/64 -o eth0 -j MASQUERADE;
firewall-cmd --direct --add-rule ipv6 filter INPUT 0 -i %i -j ACCEPT;
firewall-cmd --direct --add-rule ipv6 filter FORWARD 0 -i %i -o eth0 -j
ACCEPT;
firewall-cmd --direct --add-rule ipv6 filter FORWARD 0 -i eth0 -o %i -j
ACCEPT;
When, on the server, I switch to
FirewallBackend=nftables
and restart firewalld and do wg-quick up wg0 then I can no longer access
the DNS resolver on the wireguard server's public IPv4 & IPv6 address
from the client. If I change the DNS in the client's wireguard config to
9.9.9.9 & 2620:fe::fe then resolving on the client works fine. So
somehow the iptables and nftables backend handle this differently (or
the firewall-cmd rules are wrong?).
Anyone know how to make this work with the nftables backend?
Please let me know if you need any other information. Thanks!
Best,
Patrick
Show replies by date