How to forward traffic on various ports through a wireguard vpn using iptables/ufw

Question

I have 2 machines running ubuntu 22.04, we will call them server and proxy. The proxy is a vps with an static public ip, and the server is running behind a nat. I want to route all traffic on some ports on the proxy to the server.

I have set up a wireguard vpn beetween the 2 and both can ping each other, if i curl the vpn adress of the server from the proxy i get the correct html response, and setting up nginx on the proxy (which is not the intended final solution cause i would like to route other services that aren't http/https) allows me to proxy_pass to the vpn ip and once agin get correct html response.

But i haven't been able to set up the forward using iptables/ufw. This is my wireguard configuration that includes the iptables routing rules on interface up.

Proxy:

[Interface]
# Proxy with static ip
Address = 10.250.0.1/32
ListenPort = 23456
PrivateKey = {private key}
# packet forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1
# port forwarding
PreUp = iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.250.0.2
PostDown = iptables -t nat -D PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.250.0.2
PreUp = iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.250.0.2
PostDown = iptables -t nat -D PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.250.0.2
      
[Peer]
# main_server behind nat
PublicKey = {pub key}
AllowedIPs = 10.250.0.2/32

Server:

[Interface]
Address = 10.250.0.2/32
ListenPort = 23456
PrivateKey = {priv key}

[Peer]
PublicKey = {pub key}
Endpoint = {proxy server ip}:23456
AllowedIPs = 10.250.0.0/16
PersistentKeepalive = 25

Running sudo iptables-save -c returns the following

# Completed on Wed Aug 24 17:01:57 2022
# Generated by iptables-save v1.8.7 on Wed Aug 24 17:01:57 2022
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
[0:0] -A PREROUTING -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.250.0.2
[4:208] -A PREROUTING -p tcp -m tcp --dport 443 -j DNAT --to-destination 10.250.0.2
COMMIT

With the number of packets and bytes [4:208] increasing everytime i try to access the proxy via web browser

Answer 1

I have been struggling to get similar port forwarding working through wireguard to a service behind a NAT. My config is similar to yours, but there are two changes that you should try to get it to work.

Firstly, I found that in addition to the DNAT rule, I needed an SNAT rule. You might try something like this:

iptables -t nat -A POSTROUTING -d 10.250.0.2 -o wg0 -p tcp --dport 80 -j SNAT --to-source 10.250.0.1

Secondly, I think you should use PostUp/PreDown here rather than PreUp/PostDown. The routing rules don't seem to stick if the interface is not yet up when you run iptables, so PostUp ensures that the interface is in place first.

Taken together, and simplifying a bit by using multiport, you could try the following config on the proxy:

[Interface]
# Proxy with static ip
Address = 10.250.0.1/32
ListenPort = 23456
PrivateKey = {private key}
# packet forwarding
PreUp = sysctl -w net.ipv4.ip_forward=1
# port forwarding
PostUp = iptables -t nat -A PREROUTING -p tcp -m multiport --dports 80,443 -j DNAT --to- destination 10.250.0.2
PreDown = iptables -t nat -D PREROUTING -p tcp -m multiport --dports 80,443 -j DNAT --to- destination 10.250.0.2
PostUp = iptables -t nat -A POSTROUTING -d 10.250.0.2 -o wg0 -p tcp -m multiport --dports 80,443 -j SNAT --to-source 10.250.0.1
PreDown = iptables -t nat -D POSTROUTING -d 10.250.0.2 -o wg0 -p tcp -m multiport --dports 80,443 -j SNAT --to-source 10.250.0.1
  
[Peer]
# main_server behind nat
PublicKey = {pub key}
AllowedIPs = 10.250.0.2/32

Hope I didn't make any typographical errors in that -- best to check it carefully.