On 3/20/19 8:27 AM, Tom Eastep wrote: > On 3/18/19 3:28 AM, C. Cook wrote: >> Can anyone recommend a solution? Tracing this out I find that Shorewall >> is not actually port-forwarding my WireGuard-in port. >> >> # tcpdump -i eth0 port wgin >> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode >> listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes >> 10:52:33.881605 IP 172.52.40.200.28936 > >> 50-135-95-5.hllk.wa.frontiernet.net.wgin: UDP, length 148 >> 10:52:38.814108 IP 172.52.40.200.28936 > >> 50-135-95-5.hllk.wa.frontiernet.net.wgin: UDP, length 148 >> >> # tcpdump -i eth1 port wgin >> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode >> listening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes >> - >> >> >> My router rule is: >> >> DNAT net local:10.2.1.1 udp wgin - >> >> ... and that is accurate. But Shorewall is simply and absolutely not >> passing along the packets. I've rebooted the router and no change. I >> have never seen it before where port-forwarding does not work. >> >> I'd rather not post my shorewall dump here for the permanent record. >> >> Alternatively can someone recommend another firewall? > You can have the same problem with ANY iptables-based firewall. What can > happen with UDP is that a UDP stream can be established before the DNAT > rule is in place, establishing a connection tracking table entry that > does not DNAT. Since the nat table is only traversed on the *first* > packet of a stream, subsequent packets are not subject to DNAT. You can > resolve this problem by installing the 'conntrack' utility and executing: > > conntrack -D -p upd --dport wgin > > Installing and configuring Shorewall-init can help prevent this problem > from happening in the first place, by dropping incoming packets until > Shorewall starts. > > -Tom
Thank you Tom. I do use shorewall-init. I've found that my wgin packets were not being port-forwarded because I needed an ACCEPT rule. As soon as I added this before my DNAT rule, it started working and my inWG tunnel was established: ACCEPT net $FW udp wgin - This is perplexing because the docs say that DNAT- will set up routing only, whereas DNAT will set up routing -and- ACCEPT rules for the port-forward.
_______________________________________________ Shorewall-users mailing list Shorewall-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/shorewall-users
