RAW routing mode

[nhas]

RAW routing mode

[NHAS]

Haha, networking is hard I get it.

[NHAS]

Howdy.

Yes this is definitely supported and is why the NAT flag exists.

Could you please give me your config (without the private key).

And the output of iptables -L -n on your host.

[Cody7172]

I am testing with this configuration (for that moment using just totp as mfa). So I've read documentation several times but idk is it actually correct

{
    "Socket": "/tmp/wag.sock",
    "CheckUpdates": true,
    "Proxied": false,
    "ExposePorts": [
        "443/tcp",
        "4433/tcp",
        "8080/tcp"
    ],
    "NAT": false,
    "HelpMail": *adminmailhere*,
    "Lockout": 5,
    "ExternalAddress": "domainnamehere*",
    "MaxSessionLifetimeMinutes": 480,
    "SessionInactivityTimeoutMinutes": 1,
    "ManagementUI": {
        "ListenAddress": "domainnamehere:4433",
        "CertPath": "/root/certs/cert.crt",
        "KeyPath": "/root/certs/key.key",
        "Enabled": true
    },
    "Webserver": {
        "Public": {
            "ListenAddress": "domainnamehere:8080",
            "CertPath": "/root/certs/cert.crt",
            "KeyPath": "/root/certs/key.key"
        },
        "Tunnel": {
            "Port": "443"
        }
    },
    "Authenticators": {
        "DefaultMethod": "totp",
        "Issuer": "domainnamehere",
        "Methods": [
            "totp"
        ],
        "DomainURL": "https://domainnamehere",
        "OIDC": {
            "IssuerURL": "https://accounts.google.com",
            "ClientSecret": "secrethere",
            "ClientID": "clientidhere",
            "GroupsClaimName": "groups"
        },
        "PAM": {
            "ServiceName": ""
        }
    },
    "Wireguard": {
        "DevName": "wg0",
        "ListenPort": 5920,
        "PrivateKey": "privatekeyhere",
        "Address": "10.1.2.1/24",
        "MTU": 1420,
        "PersistentKeepAlive": 25,
        "DNS": [
            "8.8.8.8/32"
        ]
    },
    "DatabaseLocation": "devices.db",
    "Acls": {
        "Policies": {
            "*": {
                "Mfa": [
                    "10.114.0.4/24"
                ],
                "Allow": [
                    "10.1.2.0/24"
                ]
            }
        }
    }

So I trying to reach 10.114.0.0/24 via wag
Here is iptables output of ubuntu 22 host:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:4433
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8080
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8 state NEW,RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (2 references)
target     prot opt source               destination         

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target     prot opt source               destination         
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

[NHAS]

Thanks for that. Looks sane to me, what are your host ips?

E.g why ip is the wag server and what is your target that isn't working?

[Cody7172]

what are your host ips?
E.g why ip is the wag server and what is your target that isn't working?

host eth1 is 10.114.0.5/24, wg is 10.1.2.1/24
target is 10.114.0.4/24
trying to reach 10.114.0.0/24 via wag

[NHAS]

Sweet.
So are you completing the Mfa process? As youve put 10.114.0.4/24 in the Mfa block.

Secondly. Might want to make that either 10.114.0.4/32 or 10.114.0.0/24

[NHAS]

I would also say, does your other server have routes to the wag host?

I.e
ip route add 10.1.2.1/24 via 10.114.0.5

You can check this with ip r

And I'd also check on your target host (10.114.0.4) that you are receiving traffic with tcpdump.

E.g

tcpdump -i eth0 'net 10.114.0.0/24'

[Cody7172]

Thank you so much for your response!
My mistake, I just realized that 10.114.0.4 has no reverse route to 10.1.2.0
Added a route and this worked as it should