User Tools

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
networking:wireguard_redirects [2025/02/06 10:06] – willynetworking:wireguard_redirects [2025/03/13 15:01] (current) – willy
Line 1: Line 1:
-===== wireGuard Port Forwarding =====+===== K) WireGuard Port Forwarding =====
  
 I am assuming that you have already setup WireGuard both on the internal and on the external server. See [[gentoo:wireguard|this]] page for more details on the topic. I am assuming that you have already setup WireGuard both on the internal and on the external server. See [[gentoo:wireguard|this]] page for more details on the topic.
Line 11: Line 11:
   * You have one **external** host which has a public IP address   * You have one **external** host which has a public IP address
   * Both hosts have WireGuard setup according to the configuration above   * Both hosts have WireGuard setup according to the configuration above
-  * Internal host expose port 22, 80 and 8443+  * Internal host expose port 22 for SSH (optional: port 8443 for HTTPS and port 80 for HTTP)
   * External host needs to route those three ports to the internal host   * External host needs to route those three ports to the internal host
   * The WireGuard subnet is //10.100.0.0/24// with internal host being 10.100.0.1 and external host 10.100.0.2   * The WireGuard subnet is //10.100.0.0/24// with internal host being 10.100.0.1 and external host 10.100.0.2
Line 19: Line 19:
 What we need to do is create nftable rules to ensure that: What we need to do is create nftable rules to ensure that:
   * packets reaching external host on enp1s0 on port 2022 get routed to 10.100.0.1 port 22   * packets reaching external host on enp1s0 on port 2022 get routed to 10.100.0.1 port 22
-  * packets reaching external host on enp1s0 on port 80 get routed to 10.100.0.1 port 80 +  * packets reaching external host on enp1s0 on port 443 get routed to 10.100.0.1 port 8443 (optional) 
-  * packets reaching external host on enp1s0 on port 443 get routed to 10.100.0.1 port 8443+  * packets reaching external host on enp1s0 on port 80 get routed to 10.100.0.1 port 80 (optional)
   * return packets from the internal host get properly re-routed to the original sender out from enp1s0   * return packets from the internal host get properly re-routed to the original sender out from enp1s0
 +
 +**Note:** forwarding ports for HTTP and HTTPS is only required if you don't plan to host a reverse proxy on the external server, which is the recomended approach. See [[networking:proxy_chain|this page]] for more details on chaining proxies.
  
 **Note:** see [[selfhost:nginx|here]] on why i use port 8443 instead of port 443 on the internal server. This is to differentiate //internal// connections, which have lesser security, from //external// connections which get additional SSO layers. **Note:** see [[selfhost:nginx|here]] on why i use port 8443 instead of port 443 on the internal server. This is to differentiate //internal// connections, which have lesser security, from //external// connections which get additional SSO layers.
 +
 +**Note:** if you forward HTTPS, you **must** also forward HTTP (80), otherwise Let's Encrypt will be unable to renew your certificates.
  
 What we need: What we need:
Line 49: Line 53:
 # nft 'add rule ip wg prerouting iifname enp1s0 tcp dport 2022 counter' # <<- optional for debugging purposes # nft 'add rule ip wg prerouting iifname enp1s0 tcp dport 2022 counter' # <<- optional for debugging purposes
 nft 'add rule ip wg prerouting iifname enp1s0 dnat to tcp dport map { 2022 : 10.100.0.1 . 22 }' nft 'add rule ip wg prerouting iifname enp1s0 dnat to tcp dport map { 2022 : 10.100.0.1 . 22 }'
-nft 'add rule ip wg prerouting iifname enp1s0 dnat to tcp dport map { 80 : 10.100.0.1 . 80 }' +#nft 'add rule ip wg prerouting iifname enp1s0 dnat to tcp dport map { 80 : 10.100.0.1 . 80 }' optional 
-nft 'add rule ip wg prerouting iifname enp1s0 dnat to tcp dport map { 443 : 10.100.0.1 . 8443 }'+#nft 'add rule ip wg prerouting iifname enp1s0 dnat to tcp dport map { 443 : 10.100.0.1 . 8443 }' optional
 </code> </code>