From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, HTML_MESSAGE,MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA0F0C43381 for ; Wed, 20 Mar 2019 22:45:36 +0000 (UTC) Received: from krantz.zx2c4.com (krantz.zx2c4.com [192.95.5.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 90887218AE for ; Wed, 20 Mar 2019 22:45:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 90887218AE Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=barrowclift.me Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=wireguard-bounces@lists.zx2c4.com Received: from krantz.zx2c4.com (localhost [IPv6:::1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 443cc1df; Wed, 20 Mar 2019 22:45:14 +0000 (UTC) Received: from krantz.zx2c4.com (localhost [127.0.0.1]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id 1aeeadab for ; Mon, 18 Mar 2019 13:34:05 +0000 (UTC) Received: from smtprelay.hostedemail.com (smtprelay0007.hostedemail.com [216.40.44.7]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id d3609da5 for ; Mon, 18 Mar 2019 13:34:05 +0000 (UTC) Received: from filter.hostedemail.com (clb03-v110.bra.tucows.net [216.40.38.60]) by smtprelay03.hostedemail.com (Postfix) with ESMTP id 79603815ED08 for ; Mon, 18 Mar 2019 13:34:07 +0000 (UTC) X-Session-Marker: 6D61726340626172726F77636C6966742E6D65 X-HE-Tag: tin01_6b9955d36a5a X-Filterd-Recvd-Size: 6586 Received: from mail.hover.com (imap-ext [216.40.42.5]) (Authenticated sender: webmail@marc@barrowclift.me) by omf10.hostedemail.com (Postfix) with ESMTPA for ; Mon, 18 Mar 2019 13:34:06 +0000 (UTC) MIME-Version: 1.0 Date: Mon, 18 Mar 2019 06:34:05 -0700 From: marc@barrowclift.me To: wireguard@lists.zx2c4.com Subject: Traffic routing with pf Message-ID: <66225ec4096954d5aca77df9a14af635@barrowclift.me> X-Sender: marc@barrowclift.me User-Agent: Roundcube Webmail/1.2.7 X-Originating-IP: [198.178.12.46] X-Mailman-Approved-At: Wed, 20 Mar 2019 23:45:13 +0100 X-BeenThere: wireguard@lists.zx2c4.com X-Mailman-Version: 2.1.15 Precedence: list List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: multipart/mixed; boundary="===============2468428698845664418==" Errors-To: wireguard-bounces@lists.zx2c4.com Sender: "WireGuard" --===============2468428698845664418== Content-Type: multipart/alternative; boundary="=_626933245a6fc8071adf9b6fe71b8178" --=_626933245a6fc8071adf9b6fe71b8178 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII Hi everyone, I've set up a Wireguard server on a Mac Mini and can remotely connect with no problems. However, all attempts to access anything else on my server's LAN while connected have been unsuccessful. Most guides and documentation I've found to get this routing working are written with the assumption Linux's `iptables` are available [1], but on macOS the only available option appears to be `pf`. My attempts thus far to get those `iptables` rules ported correctly to `pf` have failed. Have any of you gotten LAN access working correctly on macOS with `pf`? If so, I'd greatly appreciate your guidance! ----- My server config ``` [Interface] Address = 10.0.0.3 PrivateKey = ${SERVER_PRIVATE_KEY} ListenPort = 51820 [Peer] PublicKey = ${CLIENT_PUBLIC_KEY} AllowedIPs = 10.0.0.200/32 ``` ----- My peer config ``` [Interface] Address = 10.0.0.200 PrivateKey = ${CLIENT_PRIVATE_KEY} ListenPort = 51820 [Peer] PublicKey = ${SERVER_PUBLIC_KEY} Endpoint = ${SERVER_PUBLIC_IP}:51820 AllowedIPs = 0.0.0.0/0, ::/0 PersistentKeepalive = 25 ``` ----- The script to load my `pf` rules (run before starting Wireguard on the server), using this article as a guide: https://blog.netnerds.net/2016/11/share-vpn-with-os-x-sierra-internet-sharing/ ``` sysctl -w net.inet.ip.forwarding=1 # Disable pfctl pfctl -d sleep 1 # Flushe all pfctl rules pfctl -F all sleep 1 # Starts pfctl and loads the rules from the nat-rules file pfctl -f /private/etc/nat-rules -e ``` ----- The rules themselves, saved at `/private/etc/nat-rules`. I've confirmed that `en0` is my server's ethernet interface, and `utun1` is the interface WireGuard uses (printed on WireGuard startup) ``` nat on en0 from 10.0.0.0/24 to any -> (en0) nat on utun1 from 10.0.0.0/24 to any -> (utun1) ``` Cheers, --Marc (Apologies for the duplicate message, I didn't receive any reject/accept response, and the confirmation string for canceling the message expired. Giving this another try...) Links: ------ [1] https://www.stavros.io/posts/how-to-configure-wireguard/ --=_626933245a6fc8071adf9b6fe71b8178 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=UTF-8

Hi everyone,

 
I've set up a Wireguard server on a Mac Mini and can remotely connect = with no problems. However, all attempts to access anything else on my serve= r's LAN while connected have been unsuccessful.
 
Most guides and documentation I've found to get this routing working a= re written with the assumption Linux's = `iptables` are available, but on macOS the only available option a= ppears to be `pf`. My attempts thus far to get those `iptables` rules porte= d correctly to `pf` have failed.
 
Have any of you gotten LAN access working correctly on macOS with `pf`= ? If so, I'd greatly appreciate your guidance!
 
-----
 
My server config
 
```
[Interface]
Address =3D 10.0.0.3
PrivateKey =3D ${SERVER_PRIVATE_KEY}
ListenPort =3D 51820
 
[Peer]
PublicKey =3D ${CLIENT_PUBLIC_KEY}
AllowedIPs =3D 10.0.0.200/32
```
 
-----
 
My peer config
 
```
[Interface]
Address =3D 10.0.0.200
PrivateKey =3D ${CLIENT_PRIVATE_KEY}
ListenPort =3D 51820
 
[Peer]
PublicKey =3D ${SERVER_PUBLIC_KEY}
Endpoint =3D ${SERVER_PUBLIC_IP}:51820
AllowedIPs =3D 0.0.0.0/0, ::/0
PersistentKeepalive =3D 25
```
 
-----
 
The script to load my `pf` rules (run before starting Wireguard on the= server), using this article as a guide: https://blog.netnerds.net/2016/11/share-vpn-with-os-= x-sierra-internet-sharing/
 
```
sysctl -w net.inet.ip.forwarding=3D1

# Disable pfctl
p= fctl -d
sleep 1

# Flushe all pfctl rules
pfctl -F all<= br />sleep 1

# Starts pfctl and loads the rules from the nat-rul= es file
pfctl -f /private/etc/nat-rules -e
```
 
-----
 
The rules themselves, saved at `/private/etc/nat-rules`.
I've confirmed that `en0` is my server's ethernet interface, and `utun= 1` is the interface WireGuard uses (printed on WireGuard startup)
 
```
nat on en0 from 10.0.0.0/24 to any -> (en0)
nat on utun1 from = 10.0.0.0/24 to any -> (utun1)
``` 
 
Cheers,
 
—Marc
 
(Apologies for the duplicate message, I didn't receive any reject/acce= pt response, and the confirmation string for canceling the message expired= =2E Giving this another try...)
 
--=_626933245a6fc8071adf9b6fe71b8178-- --===============2468428698845664418== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ WireGuard mailing list WireGuard@lists.zx2c4.com https://lists.zx2c4.com/mailman/listinfo/wireguard --===============2468428698845664418==--