Ian Foster
47f81dd66a
* Add per-client firewall filtering Implement server-side firewall rules to restrict client network access, allowing administrators to enforce security policies that cannot be bypassed by clients modifying their local configuration. This feature addresses the limitation where "Allowed IPs" only controls client-side routing but doesn't prevent clients from accessing networks they shouldn't reach. The firewall rules are enforced on the server using iptables/ip6tables and provide true access control. Features: - Opt-in via "Enable Per-Client Firewall" toggle in admin interface - Per-client "Firewall Allowed IPs" field for granular control - Support for IPs, CIDRs, and port-based filtering - Protocol specification: TCP, UDP, or both (default) - IPv4 and IPv6 dual-stack support - Falls back to client's allowedIps when firewallIps is empty - Clean separation of routing (allowedIps) from security (firewallIps) Supported formats: - 10.10.0.3 (single IP) - 10.10.0.0/24 (CIDR range) - 192.168.1.5:443 (IP with port, both TCP+UDP) - 192.168.1.5:443/tcp (IP with specific protocol) - [2001:db8::1]:443 (IPv6 with port) Implementation: - New database columns: firewall_enabled (interfaces), firewall_ips (clients) - Migration 0003_add_firewall_filtering for schema updates - firewall.ts utility for iptables chain management (WG_CLIENTS chain) - Integration into WireGuard.ts for automatic rule application - UI components with conditional rendering based on firewall toggle Technical details: - Uses custom WG_CLIENTS iptables chain for isolation - Rebuild strategy: flush and recreate all rules on config save - Mutex protection via rebuildInProgress/rebuildQueued flags - Graceful cleanup when firewall is disabled - No new dependencies (uses existing is-ip, is-cidr packages) * added Comprehensive documentation in README and docs/ for firewall filtering * validate firewall IPs * check for iptables before enabling the firewall and inform the user if it is missing * updated firewall docs * fix imports * remove extra import * Document all allowed IP/cidr/port/proto combinations that are allowed and check on save * add note on firewall being experimental and how to opt a single client out of the firewall. * cleanup more imports * add tests * Fix firewall IPv6 validation and test expectations Updated validation to correctly handle plain and bracketed IPv6 addresses, and fixed test to expect string from schema instead of object. * added comments to firewall rules and updated tests * fix auto-import * fix typescript errors * recreate sql migrations and rebase * improve tests, typechecking, documentation * fix formatting, fix types * improve type * added note for including host's IP in client firewall * updated language to include cidr and protocol options * another language update * refer to docs for firewall allowed IPs --------- Co-authored-by: Bernd Storath <999999bst@gmail.com>
112 lines
4.6 KiB
Markdown
112 lines
4.6 KiB
Markdown
---
|
|
title: FAQ
|
|
hide:
|
|
- navigation
|
|
---
|
|
|
|
Here are some frequently asked questions or errors about `wg-easy`. If you have a question that is not answered here, please feel free to open a discussion on GitHub.
|
|
|
|
## How do I restrict client access to specific networks or servers?
|
|
|
|
Use the **Per-Client Firewall** feature to enforce server-side restrictions on what each client can access.
|
|
|
|
**Requirements:** This feature requires `iptables` (and `ip6tables` for IPv6) to be installed on the host system.
|
|
|
|
1. Enable "Per-Client Firewall" in **Admin Panel → Interface**
|
|
2. Edit a client and configure "Firewall Allowed IPs"
|
|
3. Specify which destinations the client should be allowed to access
|
|
|
|
Unlike "Allowed IPs" which only controls client-side routing, firewall rules are enforced by the server and cannot be bypassed.
|
|
|
|
See the [Admin Panel Guide](guides/admin/#per-client-firewall) and [Client Guide](guides/clients/#firewall-allowed-ips) for detailed configuration.
|
|
|
|
## Error: WireGuard exited with the error: Cannot find device "wg0"
|
|
|
|
This error indicates that the WireGuard interface `wg0` does not exist. This can happen if the WireGuard kernel module is not loaded or if the interface was not created properly.
|
|
|
|
To resolve this issue, you can try the following steps:
|
|
|
|
1. **Load the WireGuard kernel module**: If the WireGuard kernel module is not loaded, you can load it manually by running:
|
|
|
|
```shell
|
|
sudo modprobe wireguard
|
|
```
|
|
|
|
2. **Load the WireGuard kernel module on boot**: If you want to ensure that the WireGuard kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file:
|
|
|
|
```shell
|
|
echo "wireguard" | sudo tee -a /etc/modules
|
|
```
|
|
|
|
## can't initialize iptables table `nat': Table does not exist (do you need to insmod?)
|
|
|
|
This error indicates that the `nat` table in `iptables` does not exist. This can happen if the `iptables` kernel module is not loaded or if the `nat` table is not supported by your kernel.
|
|
|
|
To resolve this issue, you can try the following steps:
|
|
|
|
1. **Load the `nat` kernel module**: If the `nat` kernel module is not loaded, you can load it manually by running:
|
|
|
|
```shell
|
|
sudo modprobe iptable_nat
|
|
```
|
|
|
|
2. **Load the `nat` kernel module on boot**: If you want to ensure that the `nat` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file:
|
|
|
|
```shell
|
|
echo "iptable_nat" | sudo tee -a /etc/modules
|
|
```
|
|
|
|
## can't initialize ip6tables table `nat': Table does not exist (do you need to insmod?)
|
|
|
|
This error indicates that the `nat` table in `ip6tables` does not exist. This can happen if the `ip6tables` kernel module is not loaded or if the `nat` table is not supported by your kernel.
|
|
|
|
To resolve this issue, you can try the following steps:
|
|
|
|
1. **Load the `nat` kernel module**: If the `nat` kernel module is not loaded, you can load it manually by running:
|
|
|
|
```shell
|
|
sudo modprobe ip6table_nat
|
|
```
|
|
|
|
2. **Load the `nat` kernel module on boot**: If you want to ensure that the `nat` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file:
|
|
|
|
```shell
|
|
echo "ip6table_nat" | sudo tee -a /etc/modules
|
|
```
|
|
|
|
## can't initialize iptables table `filter': Permission denied
|
|
|
|
This error indicates that the `filter` table in `iptables` cannot be initialized due to permission issues. This can happen if you are not running the command with sufficient privileges.
|
|
|
|
To resolve this issue, you can try the following steps:
|
|
|
|
1. **Load the `filter` kernel module**: If the `filter` kernel module is not loaded, you can load it manually by running:
|
|
|
|
```shell
|
|
sudo modprobe iptable_filter
|
|
```
|
|
|
|
2. **Load the `filter` kernel module on boot**: If you want to ensure that the `filter` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file:
|
|
|
|
```shell
|
|
echo "iptable_filter" | sudo tee -a /etc/modules
|
|
```
|
|
|
|
## can't initialize ip6tables table `filter': Permission denied
|
|
|
|
This error indicates that the `filter` table in `ip6tables` cannot be initialized due to permission issues. This can happen if you are not running the command with sufficient privileges.
|
|
|
|
To resolve this issue, you can try the following steps:
|
|
|
|
1. **Load the `filter` kernel module**: If the `filter` kernel module is not loaded, you can load it manually by running:
|
|
|
|
```shell
|
|
sudo modprobe ip6table_filter
|
|
```
|
|
|
|
2. **Load the `filter` kernel module on boot**: If you want to ensure that the `filter` kernel module is loaded automatically on boot, you can add it to the `/etc/modules` file:
|
|
|
|
```shell
|
|
echo "ip6table_filter" | sudo tee -a /etc/modules
|
|
```
|