Discuss
Hello,
I made some research and came up with a working patch for the wireguard app using nftables. I would like to share this to have reviews/opinions (I’m not a security expert..).
Patch: update conf/interfaces.json with:
"post_up": "nft add table ip filter;nft add table ip nat;nft add table ip6 filter;nft add table ip6 nat;nft add chain ip filter FORWARD { type filter hook forward priority filter\\; };nft add chain ip6 filter FORWARD { type filter hook forward priority filter\\; }; nft add chain ip nat POSTROUTING { type nat hook postrouting priority 100\\; }; nft add chain ip6 nat POSTROUTING { type nat hook postrouting priority 100\\; };nft add rule ip filter FORWARD iifname \\\"%i\\\" accept comment \\\"wg-up-%i-in\\\"; nft add rule ip filter FORWARD oifname \\\"%i\\\" accept comment \\\"wg-up-%i-out\\\"; nft add rule ip nat POSTROUTING oifname __INTERFACE__ masquerade comment \\\"wg-up-%i-nat\\\"; nft add rule ip6 filter FORWARD iifname \\\"%i\\\" accept comment \\\"wg-up-%i-in6\\\"; nft add rule ip6 filter FORWARD oifname \\\"%i\\\" accept comment \\\"wg-up-%i-out6\\\"; nft add rule ip6 nat POSTROUTING oifname __INTERFACE__ masquerade comment \\\"wg-up-%i-nat6\\\"; ip link set multicast on dev %i",
"post_down": "nft delete rule ip filter FORWARD comment \\\"wireguard_ynh-%i-in\\\"; nft delete rule ip filter FORWARD comment \\\"wireguard_ynh-%i-out\\\"; nft delete rule ip nat postrouting comment \\\"wireguard_ynh-%i-nat\\\"; nft delete rule ip6 filter FORWARD comment \\\"wireguard_ynh-%i-in6\\\"; nft delete rule ip6 filter FORWARD comment \\\"wireguard_ynh-%i-out6\\\"; nft delete rule ip6 nat postrouting comment \\\"wireguard_ynh-%i-nat6\\\""