On 3/18/19 3:28 AM, C. Cook wrote: > Can anyone recommend a solution? Tracing this out I find that Shorewall > is not actually port-forwarding my WireGuard-in port. > > # tcpdump -i eth0 port wgin > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes > 10:52:33.881605 IP 172.52.40.200.28936 > > 50-135-95-5.hllk.wa.frontiernet.net.wgin: UDP, length 148 > 10:52:38.814108 IP 172.52.40.200.28936 > > 50-135-95-5.hllk.wa.frontiernet.net.wgin: UDP, length 148 > > # tcpdump -i eth1 port wgin > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes > - > > > My router rule is: > > DNAT net local:10.2.1.1 udp wgin - > > ... and that is accurate. But Shorewall is simply and absolutely not > passing along the packets. I've rebooted the router and no change. I > have never seen it before where port-forwarding does not work. > > I'd rather not post my shorewall dump here for the permanent record. > > Alternatively can someone recommend another firewall?
You can have the same problem with ANY iptables-based firewall. What can
happen with UDP is that a UDP stream can be established before the DNAT
rule is in place, establishing a connection tracking table entry that
does not DNAT. Since the nat table is only traversed on the *first*
packet of a stream, subsequent packets are not subject to DNAT. You can
resolve this problem by installing the 'conntrack' utility and executing:
conntrack -D -p upd --dport wgin
Installing and configuring Shorewall-init can help prevent this problem
from happening in the first place, by dropping incoming packets until
Shorewall starts.
-Tom
--
Tom Eastep \ Q: What do you get when you cross a mobster with
Shoreline, \ an international standard?
Washington, USA \ A: Someone who makes you an offer you can't
http://shorewall.org \ understand
\_______________________________________________
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
