Traffic routing with pf

Traffic routing with pf

[marc]

[-- Attachment #1.1: Type: text/plain, Size: 2085 bytes --]

Hi everyone,

I've set up a Wireguard server on a Mac Mini and can remotely connect
with no problems. However, all attempts to access anything else on my
server's LAN while connected have been unsuccessful. 

Most guides and documentation I've found to get this routing working are
written with the assumption Linux's `iptables` are available [1], but on
macOS the only available option appears to be `pf`. My attempts thus far
to get those `iptables` rules ported correctly to `pf` have failed. 

Have any of you gotten LAN access working correctly on macOS with `pf`?
If so, I'd greatly appreciate your guidance! 

----- 

My server config 

``` 

[Interface] 
Address = 10.0.0.3 
PrivateKey = ${SERVER_PRIVATE_KEY} 
ListenPort = 51820 

[Peer] 
PublicKey = ${CLIENT_PUBLIC_KEY} 
AllowedIPs = 10.0.0.200/32 
``` 

----- 

My peer config 

``` 
[Interface] 

Address = 10.0.0.200 
PrivateKey = ${CLIENT_PRIVATE_KEY} 
ListenPort = 51820 

[Peer] 
PublicKey = ${SERVER_PUBLIC_KEY} 
Endpoint = ${SERVER_PUBLIC_IP}:51820 
AllowedIPs = 0.0.0.0/0, ::/0 
PersistentKeepalive = 25 
``` 

----- 

The script to load my `pf` rules (run before starting Wireguard on the
server), using this article as a guide:
https://blog.netnerds.net/2016/11/share-vpn-with-os-x-sierra-internet-sharing/


``` 
sysctl -w net.inet.ip.forwarding=1

# Disable pfctl
pfctl -d
sleep 1

# Flushe all pfctl rules
pfctl -F all
sleep 1

# Starts pfctl and loads the rules from the nat-rules file
pfctl -f /private/etc/nat-rules -e 
``` 

----- 

The rules themselves, saved at `/private/etc/nat-rules`. 
I've confirmed that `en0` is my server's ethernet interface, and `utun1`
is the interface WireGuard uses (printed on WireGuard startup) 

``` 
nat on en0 from 10.0.0.0/24 to any -> (en0)
nat on utun1 from 10.0.0.0/24 to any -> (utun1) 
```  

Cheers, 

--Marc 

(Apologies for the duplicate message, I didn't receive any reject/accept
response, and the confirmation string for canceling the message expired.
Giving this another try...) 
  

Links:
------
[1] https://www.stavros.io/posts/how-to-configure-wireguard/

[-- Attachment #1.2: Type: text/html, Size: 3374 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

Traffic routing with pf

[karog]

Marc,

You might only need to turn on ip forwarding. As a command try:

To read the current value:

sysctl net.inet.ip.forwarding

To set the value:

sudo sysctl net.inet.ip.forwarding=1

To set it on boot, create the file

/private/etc/sysctl.conf

with contents

net.inet.ip.forwarding=1


You will also need a route on your router to direct packets with destination on your wireguard subnet to go the the Mac Mini's ip address.
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard