0

I have a small VPS running WireGuard. However, I would like to set up an IP redirection with nftables. The problem is that I've been trying for days but I can't get ahead. It is probably a simple mistake on my part. When I call curl 10.3.10.24, I still get to 10.3.10.24 and not 10.3.10.1. Both IPs are behind the WireGuard tunnel. Below is my config. I am grateful for any answer :)

net.ipv4.ip_forward = 1

#!/usr/sbin/nft -f

flush ruleset

#Interfaces
define pub_iface = ens3
define wg_port = 51821

table inet basic-filter {
    chain input {
            type filter hook input priority 0; policy drop;
            ct state { established, related } accept
            iif lo accept
            ip protocol icmp accept
            ip6 nexthdr ipv6-icmp accept
            meta l4proto ipv6-icmp accept
            iif $pub_iface tcp dport 22 accept
            iif $pub_iface udp dport $wg_port accept
            iif $pub_iface udp dport 51822 accept
            iifname wg0 accept
            ct state invalid drop
            reject
    }
    chain forward {
            type filter hook forward priority 0; policy drop;
            ct state { established, related } accept
            iifname wg0 oifname $pub_iface accept
            iifname wg1 oifname $pub_iface accept
            iifname wg0 ip saddr 10.212.0.0/16 ip daddr 10.0.0.0/12 oifname wg0 accept
            ct status dnat accept
            ct state invalid drop
            reject with icmpx type host-unreachable
   }
    chain postrouting {
            type nat hook postrouting priority 100; policy accept;
            iifname wg0 oifname wg0 masquerade
            iifname wg0 oifname $pub_iface masquerade
            iifname wg1 oifname $pub_iface masquerade
            ct status dnat masquerade
    }
    chain prerouting {
            type nat hook prerouting priority -100; policy accept;
            #ip daddr 10.3.10.24 tcp dport { 80 } dnat to 10.3.10.1:80
    }
}
Jonathan
  • 43
  • 6

0 Answers0