From 40631b7876f1b1a1d064e013f51421f9207ee1b2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A9ctor=20Molinero=20Fern=C3=A1ndez?= Date: Sun, 26 Jan 2020 21:17:52 +0100 Subject: [PATCH] Allow access WireGuard via port 53/UDP --- rootfs/etc/wireguard/client-sample.conf | 2 +- rootfs/etc/wireguard/wg0.conf | 7 ++++++- start-qemu.sh | 2 +- wireguard.pkr.hcl | 2 +- 4 files changed, 9 insertions(+), 4 deletions(-) diff --git a/rootfs/etc/wireguard/client-sample.conf b/rootfs/etc/wireguard/client-sample.conf index d53b470..ae48600 100644 --- a/rootfs/etc/wireguard/client-sample.conf +++ b/rootfs/etc/wireguard/client-sample.conf @@ -6,4 +6,4 @@ DNS = 10.10.10.1 [Peer] PublicKey = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX AllowedIPs = 0.0.0.0/0, ::/0 -Endpoint = XXX.XXX.XXX.XXX:80 +Endpoint = XXX.XXX.XXX.XXX:51820 diff --git a/rootfs/etc/wireguard/wg0.conf b/rootfs/etc/wireguard/wg0.conf index 3c3a2fe..2270e02 100644 --- a/rootfs/etc/wireguard/wg0.conf +++ b/rootfs/etc/wireguard/wg0.conf @@ -1,6 +1,6 @@ [Interface] Address = 10.10.10.1/24 -ListenPort = 80 +ListenPort = 51820 # Load keys PostUp = [ -e '/etc/wireguard/%i-privatekey' ] || (umask 077 && wg genkey > '/etc/wireguard/%i-privatekey') PostUp = [ -e '/etc/wireguard/%i-publickey' ] || (umask 022 && wg pubkey < '/etc/wireguard/%i-privatekey' > '/etc/wireguard/%i-publickey') @@ -23,3 +23,8 @@ PostUp = iptables -A INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && iptables - PostUp = ip6tables -A INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && ip6tables -A INPUT -i '%i' -p udp --dport 53 -j ACCEPT PostDown = iptables -D INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && iptables -D INPUT -i '%i' -p udp --dport 53 -j ACCEPT PostDown = ip6tables -D INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && ip6tables -D INPUT -i '%i' -p udp --dport 53 -j ACCEPT +# Allow access WireGuard via port 53/UDP (to circumvent some firewalls) +PostUp = iptables -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 +PostUp = ip6tables -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 +PostDown = iptables -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 +PostDown = ip6tables -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 diff --git a/start-qemu.sh b/start-qemu.sh index 74dd448..89348b5 100755 --- a/start-qemu.sh +++ b/start-qemu.sh @@ -29,6 +29,6 @@ kvm \ -smp 1 -m 512 \ -nographic -serial mon:stdio \ -device e1000,netdev=n0 \ - -netdev user,id=n0,hostfwd=tcp::2222-:22,hostfwd=tcp::8080-:80 \ + -netdev user,id=n0,hostfwd=tcp::2222-:22,hostfwd=udp::5353-:53 \ -drive file="${SNAPSHOT_DISK:?}",if=virtio,format=qcow2 \ -drive file="${USERDATA_DISK:?}",if=virtio,format=raw diff --git a/wireguard.pkr.hcl b/wireguard.pkr.hcl index 32dfebc..8bc3fe2 100644 --- a/wireguard.pkr.hcl +++ b/wireguard.pkr.hcl @@ -108,7 +108,7 @@ build { "ufw default deny incoming", "ufw default allow outgoing", "ufw allow from any to any port 22 proto tcp", - "ufw allow from any to any port 80 proto udp" + "ufw allow from any to any port 51820 proto udp" ] }