I have an idea to host a web app that without built-in authentication on my server. And protect it by nftables, WireGuard and Reverse Path Forwarding only. The web server will listen to the server's WireGuard interface address, 10.0.0.1 in this example.
Princple:
- The WireGuard use public-key cryptography to authenticate users, similar to the behavior of SSH public key authentication
fib daddr . iif type != local
, Reverse Path Forwarding and the wg0 interface address 10.0.0.1/24 can restrict only the wg0's peer can access 10.0.0.1- web server will only listen to 10.0.0.1
Is that secure? Is there any potential vulnerability? Any comments are appreciated.
sysctl
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
The server's WireGuard interface
#wg0
[Interface]
Address = 10.0.0.1/24
# My trusted device
[Peer]
PublicKey = $server_publickey
AllowedIPs = 10.0.0.2/32
nftables.conf
table ip filter {
chain PREROUTING {
type filter hook prerouting priority filter; policy accept;
fib daddr . iif type != local drop
}
}
Update, A real example
To secure a Syncthing GUI on server without using password
- The Syncthing GUI is listening 127.0.0.1:8384
- User device will access the GUI through Apache reverse proxy
- The Apache reverse proxy is opened to Internet because the server is hosting other services.
- The http request is coming a VPS router via WireGuard.
<VirtualHost *:443>
ServerName syncthing.$DOMAIN
SSLEngine on
ProxyPass / http://localhost:8384/
ProxyPassReverse / http://localhost:8384/
<Location "/">
Require ip 10.1.0
</Location>
</VirtualHost>
chain STRONG {
type filter hook input priority raw; policy accept;
ip saddr 10.1.0.0/24 iifname != { "lo", "wg0" } drop
}
[Interface]
Address = $home_server_wg_ip_address/30
PrivateKey = $home_server_privatekey
Table = $VPS_INTERFACE_TABLE
PreUp = ip rule add from $home_server_wg_ip_address/32 lookup $VPS_INTERFACE_TABLE priority $VPS_INTERFACE_TABLE_PRIORITY
PostDown = ip rule del from $home_server_wg_ip_address/32 lookup $VPS_INTERFACE_TABLE priority $VPS_INTERFACE_TABLE_PRIORITY
[Peer]
PublicKey = $vps_publickey
Endpoint = $vps_ip_address:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25