I use a WireGuard VPM to reversely connect to my home server via an external entry node. On that entry node, I try to add a firewall rule using ufw. Its purpose is to only allow routing to one and only one specific IP (10.0.0.6).
So the basic setup is:
10.0.0.1 entry node (publicly available, responsible for routing packets inside the VPN)
10.0.0.6 home server (should be reachable for any machine in the VPN)
10.0.0.13 any other peer (should not be reachable for other peers, therefor the ufw rule)
Routing packets via the entry node works fine, but the firewall rule does not deny other target IPs.
My setup looks like this:
user@host:~$ sudo ufw route allow in on wg0 out on wg0 to 10.0.0.6/32
Rule added
->
user@host:~$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), deny (routed)
New profiles: skip
To Action From
-- ------ ----
...
[firewall rules]
...
10.0.0.6 on wg0 ALLOW FWD Anywhere on wg0
(Note: I removed other rules. They are not related to routing, only ALLOW IN / LIMIT IN rules)
Above output clearly shows Default: .. deny (routed), while the following output claims "ACCEPT" policy in all chains.
user@host:~$ sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Surprisingly, the following command shows different:
user@host:~$ sudo iptables -L
Chain INPUT (policy DROP)
...
Chain FORWARD (policy DROP)
target prot opt source destination
ufw-before-logging-forward all -- anywhere anywhere
ufw-before-forward all -- anywhere anywhere
ufw-after-forward all -- anywhere anywhere
ufw-after-logging-forward all -- anywhere anywhere
ufw-reject-forward all -- anywhere anywhere
ufw-track-forward all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
...
This unanswered question on askubuntu contains a comment from saiarcot895, who seems to have a related issue (it is where I found the idea to try the two preceding commands).
Whatever I've tried so far, I can still ping e.g. 10.0.0.13 from the home server.
user@home-server:~$ ping 10.0.0.2
PING 10.0.0.2 (10.0.0.2) 56(84) bytes of data.
64 bytes from 10.0.0.2: icmp_seq=1 ttl=63 time=58.0 ms
64 bytes from 10.0.0.2: icmp_seq=2 ttl=63 time=51.7 ms
I would expect, however, that this ping package does not get routed, and therefor returns a timeout or similar.
My question is Is this expected behaviour, and if yes, how would I create the respective rule with ufw?
Weirdly enough, I could not find an answer in the far far internetwork. But this should be easy, so I dive once again into the ufw manpage. If you have any idea meanwhile, let me know!
