Traffic routing with pf

From: marc@barrowclift.me
To: wireguard@lists.zx2c4.com
Subject: Traffic routing with pf
Date: Mon, 18 Mar 2019 06:34:05 -0700	[thread overview]
Message-ID: <66225ec4096954d5aca77df9a14af635@barrowclift.me> (raw)

[-- Attachment #1.1: Type: text/plain, Size: 2085 bytes --]

Hi everyone,

I've set up a Wireguard server on a Mac Mini and can remotely connect
with no problems. However, all attempts to access anything else on my
server's LAN while connected have been unsuccessful. 

Most guides and documentation I've found to get this routing working are
written with the assumption Linux's `iptables` are available [1], but on
macOS the only available option appears to be `pf`. My attempts thus far
to get those `iptables` rules ported correctly to `pf` have failed. 

Have any of you gotten LAN access working correctly on macOS with `pf`?
If so, I'd greatly appreciate your guidance! 

----- 

My server config 

``` 

[Interface] 
Address = 10.0.0.3 
PrivateKey = ${SERVER_PRIVATE_KEY} 
ListenPort = 51820 

[Peer] 
PublicKey = ${CLIENT_PUBLIC_KEY} 
AllowedIPs = 10.0.0.200/32 
``` 

----- 

My peer config 

``` 
[Interface] 

Address = 10.0.0.200 
PrivateKey = ${CLIENT_PRIVATE_KEY} 
ListenPort = 51820 

[Peer] 
PublicKey = ${SERVER_PUBLIC_KEY} 
Endpoint = ${SERVER_PUBLIC_IP}:51820 
AllowedIPs = 0.0.0.0/0, ::/0 
PersistentKeepalive = 25 
``` 

----- 

The script to load my `pf` rules (run before starting Wireguard on the
server), using this article as a guide:
https://blog.netnerds.net/2016/11/share-vpn-with-os-x-sierra-internet-sharing/

``` 
sysctl -w net.inet.ip.forwarding=1

# Disable pfctl
pfctl -d
sleep 1

# Flushe all pfctl rules
pfctl -F all
sleep 1

# Starts pfctl and loads the rules from the nat-rules file
pfctl -f /private/etc/nat-rules -e 
``` 

----- 

The rules themselves, saved at `/private/etc/nat-rules`. 
I've confirmed that `en0` is my server's ethernet interface, and `utun1`
is the interface WireGuard uses (printed on WireGuard startup) 

``` 
nat on en0 from 10.0.0.0/24 to any -> (en0)
nat on utun1 from 10.0.0.0/24 to any -> (utun1) 
```  

Cheers, 

--Marc 

(Apologies for the duplicate message, I didn't receive any reject/accept
response, and the confirmation string for canceling the message expired.
Giving this another try...) 

Links:
------
[1] https://www.stavros.io/posts/how-to-configure-wireguard/

[-- Attachment #1.2: Type: text/html, Size: 3374 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard