Back

It’s been a long time since I did forwarding through wireguard so this might be outdated, missing info or actually doing unneeded stuff but I had this notes saved in some old iptables personal documentation from like 4 years ago that might shed you some light:

Allow first packet to start the connection

iptables -A FORWARD -i eth0 -o wg0 -p tcp --syn --dport 80 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -i eth0 -o wg0 -p tcp --syn --dport 443 -m conntrack --ctstate NEW -j ACCEPT

Allow already established connections

iptables -A FORWARD -i eth0 -o wg0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -i wg0 -o eth0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Send whatever arrives via port 80 or 443 to the other side of the wg tunnel

iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.3.1
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination 192.168.3.1

Modify source address so it can return

iptables -t nat -A POSTROUTING -o wg0 -p tcp --dport 80 -d 192.168.3.1 -j SNAT --to-source 192.168.3.2
iptables -t nat -A POSTROUTING -o wg0 -p tcp --dport 443 -d 192.168.3.1 -j SNAT --to-source 192.168.3.2

@eskuero @SexualPolytope do you have the nftables version?

If I run iptables directly, it tells me that I have the nf_tables version.