# \[Wireguard\] upgrade for compatibility with nftables

**URL:** https://forum.yunohost.org/t/wireguard-upgrade-for-compatibility-with-nftables/42504
**Category:** Apps
**Tags:** english
**Created:** [June 22, 2026, 8:16am UTC](https://forum.yunohost.org/t/wireguard-upgrade-for-compatibility-with-nftables/42504 "2026-06-22T08:16:10Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![grumpyPanda](https://forum.yunohost.org/letter_avatar_proxy/v4/letter/g/b5ac83/32.png) [@grumpyPanda](https://forum.yunohost.org/u/grumpyPanda)
#### Post date: [June 22, 2026, 8:16am UTC](https://forum.yunohost.org/t/wireguard-upgrade-for-compatibility-with-nftables/42504/1 "2026-06-22T08:16:10Z")

</div>

### Discuss

Hello,

I made some research and came up with a **working patch** for the wireguard app using nftables. I would like to share this to have reviews/opinions (I’m not a security expert..).

Patch: update conf/interfaces.json with:

```auto
"post_up": "nft add table ip filter;nft add table ip nat;nft add table ip6 filter;nft add table ip6 nat;nft add chain ip filter FORWARD { type filter hook forward priority filter\\; };nft add chain ip6 filter FORWARD { type filter hook forward priority filter\\; }; nft add chain ip nat POSTROUTING { type nat hook postrouting priority 100\\; }; nft add chain ip6 nat POSTROUTING { type nat hook postrouting priority 100\\; };nft add rule ip filter FORWARD iifname \\\"%i\\\" accept comment \\\"wg-up-%i-in\\\"; nft add rule ip filter FORWARD oifname \\\"%i\\\" accept comment \\\"wg-up-%i-out\\\"; nft add rule ip nat POSTROUTING oifname __INTERFACE__ masquerade comment \\\"wg-up-%i-nat\\\"; nft add rule ip6 filter FORWARD iifname \\\"%i\\\" accept comment \\\"wg-up-%i-in6\\\"; nft add rule ip6 filter FORWARD oifname \\\"%i\\\" accept comment \\\"wg-up-%i-out6\\\"; nft add rule ip6 nat POSTROUTING oifname __INTERFACE__ masquerade comment \\\"wg-up-%i-nat6\\\"; ip link set multicast on dev %i",
        "post_down": "nft delete rule ip filter FORWARD comment \\\"wireguard_ynh-%i-in\\\"; nft delete rule ip filter FORWARD comment \\\"wireguard_ynh-%i-out\\\"; nft delete rule ip nat postrouting comment \\\"wireguard_ynh-%i-nat\\\"; nft delete rule ip6 filter FORWARD comment \\\"wireguard_ynh-%i-in6\\\"; nft delete rule ip6 filter FORWARD comment \\\"wireguard_ynh-%i-out6\\\"; nft delete rule ip6 nat postrouting comment \\\"wireguard_ynh-%i-nat6\\\""

```