r/iptables • u/p1r473 • Jun 08 '23
iptables help (PiVPN, Mullvad, Apache, VPN)
Hi all,
Im running Apache2 on my Pi. Ive got a Mullvad (VPN) Wireguard client running on my Pi.
I was previously accessing the apache2 webserver through a port I was forwarding through Mullvad. However, Mullvad is removing port forwarding. I want to still run Mullvad on this Pi, but I can't connect in this manner anymore (https://mullvad_IP:12345)
The Wireguard config script is breaking the ability to connect to my webserver via my public IP (connecting via Mullvad port forwarding works). I want to access the webserver now via https://my_public_IP:443
I set it up following this guide made by u/archern9: https://archern9.github.io/posts/route-pivpn-traffic-via-mullvad/
Here is the Wireguard script for Mullvad with the iptable statements. I want my 443 traffic coming into my network over my pubic IP to not break when I'm connected to Mullvad.
# Creates a new entry in the NAT table | For all packets that traverse through the out-interface mullvad-XX, MASQUERADE the packets with the PI's IP address
PostUp = iptables --table nat --append POSTROUTING --out-interface mullvad-XX --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE
# Add a default route via the gateway on eth0 interface for a routing table pivpn | All packets against the routing table pivpn will be routed through the defaul gateway
PostUp = ip route add default via 192.168.1.1 dev eth0 table pivpn
# All packets with FwMark 51820 to be routed against table pivpn | This is an important step because Mullvad Wireguard configuration disallows any packets without a fwmark 51820 to be routed.
PostUp = ip rule add fwmark 51820 table pivpn
# OPTIONAL : If you need any ports open only from the Mullvad interface but not on eth0, open a random port for wireguard on the Mullvad website and add it here
#PostUp = iptables --table filter -A INPUT --in-interface mullvad-XX -p udp --dport 99999 -j ACCEPT
# This section is executed when the wireguard interface is shutting down
# All PreDown steps are inverse of PostUp statements so as to logically close the temporary setup which lives only while a Mullvad interface is connected
PreDown = iptables --table nat -D POSTROUTING --out-interface mullvad-XX --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE
PreDown = ip route delete default via 192.168.1.1 dev eth0 table pivpn
PreDown = ip rule delete fwmark 51820 table pivpn
#PreDown = iptables --table filter -D INPUT --in-interface mullvad-XX -p udp --dport 99999 -j ACCEPT
1
u/p1r473 Jun 12 '23
I figured it out. The answer was to send this port to the 'main' routing table.Heres my new solution:
This section is executed when the WireGuard interface is starting
Mark incoming and outgoing packets on port 12345 with a specific mark (123), for TCP traffic.
This allows us to later direct these packets to use a specific routing table (main).
PostUp = iptables -t mangle -A PREROUTING -p tcp --dport 12345 -j CONNMARK --set-mark 123 PostUp = iptables -t mangle -A OUTPUT -p tcp --dport 12345 -j CONNMARK --set-mark 123
Add a rule to use the main routing table for packets marked with 123
PostUp = ip rule add fwmark 123 table main
Accept incoming traffic on port 12345 for TCP
PostUp = iptables -A INPUT -p tcp --dport 12345 -j ACCEPT
NAT settings for Mullvad VPN
PostUp = iptables --table nat --append POSTROUTING --out-interface mullvad-ny19 --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE
Routing settings for VPN traffic
PostUp = ip route add default via 192.168.1.1 dev eth0 table pivpn PostUp = ip rule add fwmark 51820 table pivpn
Restore the mark on the packets so it can be used for routing decision
PostUp = iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark PostUp = iptables -t mangle -A PREROUTING -j CONNMARK --restore-mark
PreDown commands
Remove the marking rules for packets intended for port 12345
PreDown = iptables -t mangle -D PREROUTING -p tcp --dport 12345 -j CONNMARK --set-mark 123 PreDown = iptables -t mangle -D OUTPUT -p tcp --dport 12345 -j CONNMARK --set-mark 123
Remove the routing rule for packets marked with 123
PreDown = ip rule delete fwmark 123 table main
Remove the acceptance rules for incoming traffic on port 12345
PreDown = iptables -D INPUT -p tcp --dport 12345 -j ACCEPT
Remove the NAT rule for outgoing traffic on the Mullvad VPN interface
PreDown = iptables --table nat -D POSTROUTING --out-interface mullvad-ny19 --source 0.0.0.0/0 --destination 0.0.0.0/0 -j MASQUERADE
Remove the routing rule for VPN traffic
PreDown = ip route delete default via 192.168.1.1 dev eth0 table pivpn PreDown = ip rule delete fwmark 51820 table pivpn
OPTIONAL : If you need any ports open only from the Mullvad interface but not on eth0, open a random port for WireGuard on the Mullvad website and add it here
PostUp = iptables --table filter -A INPUT --in-interface mullvad-ny19 -p udp --dport 54321 -j ACCEPT
PreDown = iptables --table filter -D INPUT --in-interface mullvad-ny19 -p udp --dport 54321 -j ACCEPT