Add UFW configuration to the wireguard internal docs - #1205
Conversation
Signed-off-by: Robin Rijkeboer <robin@richblox.nl>
✅ Deploy Preview for pihole-docs ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
Signed-off-by: Robin Rijkeboer <robin@richblox.nl>
DL6ER
left a comment
DL6ER
left a comment
There was a problem hiding this comment.
Thanks for filling this gap - UFW's default DEFAULT_FORWARD_POLICY=DROP really does bite people here, and it is not documented anywhere else. A few things to sort before we merge, one of them blocking:
- Wrong IPv4 subnet (blocking). The new rules use
10.10.10.0/24, but this whole guide uses10.100.0.0/24for the WireGuard-internal range (server10.100.0.1/24, clients10.100.0.2/32,DNS = 10.100.0.1). The IPv6 rule correctly reusesfd08:4711::/64, which makes the IPv4 value stand out as a leftover from your own network. As written, someone copy-pasting allows forwarding for a subnet they never use and the tunnel still will not route. - Framing. The
nftables/iptablesmasquerade rules above still work under UFW - UFW additionally drops forwarded packets, so this step is in addition to the NAT config, not a replacement. "the above doesn't work" reads as if it were a third alternative to the NAT methods. - Small stuff.
COMMITis an uppercase literal in these files (the IPv4 paragraph lowercases it), andsudo systemctl restart ufw(orsudo ufw reload) would match the rest of the guide.
Left inline notes on the specific lines.
|
|
||
| ### `ufw` | ||
|
|
||
| If you are using UFW the above doesn't work and you will need to edit `/etc/ufw/before.rules`: |
There was a problem hiding this comment.
UFW does not replace the NAT rules above - the nftables/iptables masquerade still runs; UFW just drops forwarded packets on top of it. Could we reword along the lines of:
UFW drops forwarded packets by default, so in addition to the NAT rules above you need to allow forwarding for the tunnel subnet by editing
/etc/ufw/before.rules:
As-is, "the above doesn't work" reads as if UFW were an alternative to the nftables/iptables method rather than an extra step on top of it.
| -A ufw-before-forward -s 10.10.10.0/24 -j ACCEPT | ||
| -A ufw-before-forward -d 10.10.10.0/24 -j ACCEPT |
There was a problem hiding this comment.
Blocking: this guide uses 10.100.0.0/24 for the WireGuard-internal IPv4 range everywhere else (10.100.0.1/24, 10.100.0.2/32, DNS = 10.100.0.1). 10.10.10.0/24 looks like a leftover from your own network - a reader copy-pasting it allows forwarding for a subnet they do not use, so forwarding still fails. Please change both lines to 10.100.0.0/24. The IPv6 rule below already reuses the guide's fd08:4711::/64, so only the IPv4 side needs the fix.
|
|
||
| If you are using UFW the above doesn't work and you will need to edit `/etc/ufw/before.rules`: | ||
|
|
||
| Insert this into the before.rules file but **before** the FIRST commit line: |
There was a problem hiding this comment.
COMMIT is an uppercase literal directive in before.rules, but it is written as lowercase "commit" here while the IPv6 paragraph below writes "COMMIT". Let us use COMMIT in both places so it is consistent and matches what a reader actually greps for in the file.
| -A ufw6-before-forward -d fd08:4711::/64 -j ACCEPT | ||
| ``` | ||
|
|
||
| Restart ufw for the changes to take effect: `systemctl restart ufw` |
There was a problem hiding this comment.
The rest of the guide prefixes root commands with sudo; sudo systemctl restart ufw (or the more idiomatic sudo ufw reload) would match.
✅ Deploy Preview for pihole-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
2 participants
Thank you for your contribution to the Pi-hole Community!
Please read the comments below to help us consider your Pull Request.
We are all volunteers and completing the process outlined will help us review your commits quicker.
Please make sure you
What does this PR aim to accomplish?:
Add UFW configuration to the documentation as I had issues with UFW and it wasn't mentioned anywhere.
How does this PR accomplish the above?:
Add the correct documentation to make it work.
Link documentation PRs if any are needed to support this PR:
By submitting this pull request, I confirm the following:
git rebase)