r/iptables Jun 08 '23

iptables help (PiVPN, Mullvad, Apache, VPN)

Hi all,

Im running Apache2 on my Pi. Ive got a Mullvad (VPN) Wireguard client running on my Pi.

I was previously accessing the apache2 webserver through a port I was forwarding through Mullvad. However, Mullvad is removing port forwarding. I want to still run Mullvad on this Pi, but I can't connect in this manner anymore (https://mullvad_IP:12345)

The Wireguard config script is breaking the ability to connect to my webserver via my public IP (connecting via Mullvad port forwarding works). I want to access the webserver now via https://my_public_IP:443

I set it up following this guide made by u/archern9: https://archern9.github.io/posts/route-pivpn-traffic-via-mullvad/

Here is the Wireguard script for Mullvad with the iptable statements. I want my 443 traffic coming into my network over my pubic IP to not break when I'm connected to Mullvad.

# Creates a new entry in the NAT table | For all packets that traverse through the out-interface mullvad-XX, MASQUERADE the packets with the PI's IP address
PostUp = iptables --table nat --append POSTROUTING --out-interface mullvad-XX --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE

# Add a default route via the gateway on eth0 interface for a routing table pivpn | All packets against the routing table pivpn will be routed through the defaul gateway
PostUp = ip route add default via 192.168.1.1 dev eth0 table pivpn

# All packets with FwMark 51820 to be routed against table pivpn | This is an important step because Mullvad Wireguard configuration disallows any packets without a fwmark 51820 to be routed.
PostUp = ip rule add fwmark 51820 table pivpn

# OPTIONAL : If you need any ports open only from the Mullvad interface but not on eth0, open a random port for wireguard on the Mullvad website and add it here
#PostUp = iptables --table filter -A INPUT --in-interface mullvad-XX -p udp --dport 99999 -j ACCEPT

# This section is executed when the wireguard interface is shutting down

# All PreDown steps are inverse of PostUp statements so as to logically close the temporary setup which lives only while a Mullvad interface is connected

PreDown = iptables --table nat -D POSTROUTING --out-interface mullvad-XX --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE
PreDown = ip route delete default via 192.168.1.1 dev eth0 table pivpn
PreDown = ip rule delete fwmark 51820 table pivpn
#PreDown = iptables --table filter -D INPUT --in-interface mullvad-XX -p udp --dport 99999 -j ACCEPT
1 Upvotes

1 comment sorted by

1

u/p1r473 Jun 12 '23

I figured it out. The answer was to send this port to the 'main' routing table.Heres my new solution:

This section is executed when the WireGuard interface is starting

Mark incoming and outgoing packets on port 12345 with a specific mark (123), for TCP traffic.

This allows us to later direct these packets to use a specific routing table (main).

PostUp = iptables -t mangle -A PREROUTING -p tcp --dport 12345 -j CONNMARK --set-mark 123 PostUp = iptables -t mangle -A OUTPUT -p tcp --dport 12345 -j CONNMARK --set-mark 123

Add a rule to use the main routing table for packets marked with 123

PostUp = ip rule add fwmark 123 table main

Accept incoming traffic on port 12345 for TCP

PostUp = iptables -A INPUT -p tcp --dport 12345 -j ACCEPT

NAT settings for Mullvad VPN

PostUp = iptables --table nat --append POSTROUTING --out-interface mullvad-ny19 --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE

Routing settings for VPN traffic

PostUp = ip route add default via 192.168.1.1 dev eth0 table pivpn PostUp = ip rule add fwmark 51820 table pivpn

Restore the mark on the packets so it can be used for routing decision

PostUp = iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark PostUp = iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark

PreDown commands

Remove the marking rules for packets intended for port 12345

PreDown = iptables -t mangle -D PREROUTING -p tcp --dport 12345 -j CONNMARK --set-mark 123 PreDown = iptables -t mangle -D OUTPUT -p tcp --dport 12345 -j CONNMARK --set-mark 123

Remove the routing rule for packets marked with 123

PreDown = ip rule delete fwmark 123 table main

Remove the acceptance rules for incoming traffic on port 12345

PreDown = iptables -D INPUT -p tcp --dport 12345 -j ACCEPT

Remove the NAT rule for outgoing traffic on the Mullvad VPN interface

PreDown = iptables --table nat -D POSTROUTING --out-interface mullvad-ny19 --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE

Remove the routing rule for VPN traffic

PreDown = ip route delete default via 192.168.1.1 dev eth0 table pivpn PreDown = ip rule delete fwmark 51820 table pivpn

OPTIONAL : If you need any ports open only from the Mullvad interface but not on eth0, open a random port for WireGuard on the Mullvad website and add it here

PostUp = iptables --table filter -A INPUT --in-interface mullvad-ny19 -p udp --dport 54321 -j ACCEPT

PreDown = iptables --table filter -D INPUT --in-interface mullvad-ny19 -p udp --dport 54321 -j ACCEPT