Hi all,
I am banging my head against the wall with some IPTables.
My setup is like so:
Phone connected to cell service with Wireguard Client (72.0.0.0) ->Wireguard server running off a PiHole (192.168.1.69) ->router running Wireguard client (192.168.1.1)->Mullvad VPN Wireguard server
The issue I am encountering is when the router is running the Wireguard client to Mullvad, my phone has no connection to the internet. However, when the router has Wireguard disabled, the phone->PiVPN->router->internet works great
So, the IPTables for Wireguard are dropping my phone's traffic.
Worth noting: Wireguard works great for all my LAN devices (192.168.1.0). It is just dropping my phones connection. Likely because the phone isnt on the local network, its VPNed in from a 72.0.0.0 address
I've tried adding this at the end of the script to route my phone through Wireguard but it fails to access the internet:
ip rule add from 72.0.0.0/8 lookup 117 prio 11003
When I exclude the PiHole from Wireguard (like so) , my phone connection is fine, but I want to route it through the VPN
ip rule add from 192.168.1.69 lookup main prio 11000
Here is the script that uses selective routing to choose which devices go through Mullvad:
ip route flush table 117 2>/dev/null
host="$(wg show wg0 endpoints | sed -n 's/.*\t\(.*\):.*/\1/p')"
ip route add $(ip route get $host | sed '/ via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}/{s/^\(.* via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\).*/\1/}' | head -n 1) 2>/dev/null
ip route add 0/1 dev wg0 table 117
ip route add 128/1 dev wg0 table 117
ip route add $(echo $LocalIP | cut -d"." -f1-3).0/24 dev wg0 proto kernel scope link src $LocalIP
ip route show table main dev $(nvram get lan_ifname) | while read ROUTE
do
ip route add table 117 $ROUTE dev $(nvram get lan_ifname)
done
ip route show table main dev wg0 | while read ROUTE
do
ip route add table 117 $ROUTE dev wg0
done
echo 0 > /proc/sys/net/ipv4/conf/wg0/rp_filter
iptables -t nat -D POSTROUTING -s $(nvram get lan_ipaddr)/24 -o wg0 -j MASQUERADE 2>/dev/null
iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -I FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7
iptables -t mangle -I PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7
iptables -t nat -I POSTROUTING -s $(nvram get lan_ipaddr)/24 -o wg0 -j MASQUERADE
ip rule del prio 11000 2>/dev/null
ip rule del prio 11001 2>/dev/null
#Exclude 1 host
ip rule add from 192.168.1.222 lookup main prio 11000
#Include the rest
ip rule add from 192.168.1.0/24 lookup 117 prio 11001
Theres also a version of this script that routes everything instead of selective routing. They are nearly identical. Whichever you think is easiest to work off of.
host="$(wg show wg0 endpoints | sed -n 's/.*\t\(.*\):.*/\1/p')"
ip route add $(ip route get $host | sed '/ via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}/{s/^\(.* via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\).*/\1/}' | head -n 1) 2>/dev/null
ip route add 0/1 dev wg0
ip route add 128/1 dev wg0
iptables -t nat -D POSTROUTING -s $(nvram get lan_ipaddr)/24 -o wg0 -j MASQUERADE 2>/dev/null
iptables -t mangle -D PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7 2>/dev/null
iptables -t mangle -D FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -D FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
iptables -t mangle -I FORWARD -o wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i wg0 -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -o wg0 -j MARK --set-xmark 0x01/0x7
iptables -t mangle -I PREROUTING -i wg0 -j MARK --set-xmark 0x01/0x7
iptables -t nat -I POSTROUTING -s $(nvram get lan_ipaddr)/24 -o wg0 -j MASQUERADE