I want to use an ubuntu 18.04 box (at running a WireGuard client for a commercial VPN as gateway to the LAN. WG is using wg-quick and enabled as a service. Unbound is installed and systemd-resolved is set to DNSStubListener=no. resolv.conf is set to use the same DNS server designated by the VPN provider (per wg0.conf).

The main router is at and blocks external access to the VPN gateway (I know INPUT is open).

The gateway is working, but two concerns:

A) IPtables rules need work. How to tighten the rules when the goal is only to allow the box to work as a gateway? I want to use IPtables only for the config necessary to make this work, all else should go in UFW, which is not yet installed. These IPtables rules will be placed in wg0.conf's PostUp/PostDown.

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --       anywhere             tcp dpt:domain
ACCEPT     udp  --       anywhere             udp dpt:domain
DROP       udp  --  anywhere             anywhere             udp dpt:domain
DROP       tcp  --  anywhere             anywhere             tcp dpt:domain

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

B) ProxyARP is enabled (=1), per this recommendation, but is it really needed? There is no other guide that recommends turning it on.

  • Properly configuring your input chain to lock out other traffic would be a good first step. You've got a default ACCEPT rule on INPUT so any traffic coming inbound would be accepted. That's probably the best thing for the iptables hardening. You'll need to add a few rules to make that work properly. – Thomas Ward Jan 4 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.