Home / server / Questions / 1150149
Accepted
ron
Asked: 2023-12-20 23:06:44 +0800 CST

Can iptables relate the physical wireguard UDP connection to the tunneled TCP session?

  • 772

I'm locking down the egress of my Linux box, making OUTPUT chain default deny.

My wireguard peers are from the subnet 10.1.0.0/16. Originally I thought I can just -A OUTPUT -d 10.1.0.0/16 -j ACCEPT, and while that is needed, it is not sufficient in itself.

As confirmed by tracing, the physical UDP connection to the wireguard peer also needs allowing, which makes sense on second thought.

Now, I could go on and manually allow the wireguard port of the peer endpoints. But I wonder if there's some more automatic mechanism, that would relate the physical UDP packets to the already allowed tunnel packet, and automatically allow it?

iptables

2 Answers

  1. Best Answer

    WireGuard provides the means to handle this with iptables: by setting a firewall mark on the outgoing envelope packets. This is available through the low level wg command and thus also available with wg-quick:

    • FwMark — a 32-bit fwmark for outgoing packets. If set to 0 or "off", this option is disabled. May be specified in hexadecimal by prepending "0x". Optional.

    wg-quick provides an example to be used in PostUp:

    Building on the last example, one might attempt the so-called ``kill-switch'', in order to prevent the flow of unencrypted packets through the non-WireGuard interfaces, by adding the following two lines PostUp and PreDown lines to the [Interface] section:

    PostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT
PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT

    For this problem's use case (which has an inverted logic since using a default drop policy and doesn't require to distinguish the local case) that would be something like this in the configuration file:

    [Interface]
...
FwMark = 0xcafe # or any non-zero value
...

PostUp = iptables -A OUTPUT ! -o %i -m mark --mark $(wg show %i fwmark) -j ACCEPT
PreDown = iptables -D OUTPUT ! -o %i -m mark --mark $(wg show %i fwmark) -j ACCEPT

    Or this rule can be added outside of WireGuard's configuration, probably using directly the WireGuard interface name (eg: wg0) instead of %i and the firewall mark value 0xcafe in the rule rather than querying the value from WireGuard.

    If the peer roams, the rule will still be able to track it for outgoing envelope packets.

    • 3

  2. If, by "physical UDP" you mean traffic to the peer outside of the VPN tunnel then, no. While it is possible to associate traffic on different ports to the same address via iptables (port-knocking is a good example) in this case, the traffic flows inside and outside the tunnel are going to different IP addresses.

    • 0