From 3f3138f555239fc7322accde8a7c69a07bada018 Mon Sep 17 00:00:00 2001 From: David Myers Date: Tue, 25 Feb 2020 01:43:25 -0500 Subject: [PATCH] Fix IPsec DNS when WireGuard uses port 53 (#1719) * Fix IPsec DNS when WireGuard uses port 53 * Change ACCEPT to RETURN --- roles/common/templates/rules.v4.j2 | 1 + roles/common/templates/rules.v6.j2 | 1 + 2 files changed, 2 insertions(+) diff --git a/roles/common/templates/rules.v4.j2 b/roles/common/templates/rules.v4.j2 index 764008a..a4209f7 100644 --- a/roles/common/templates/rules.v4.j2 +++ b/roles/common/templates/rules.v4.j2 @@ -32,6 +32,7 @@ COMMIT {% if wireguard_enabled and wireguard_port|int == wireguard_port_avoid|int %} # Handle the special case of allowing access to WireGuard over an already used # port like 53 +-A PREROUTING -s {{ subnets|join(',') }} -p udp --dport {{ wireguard_port_avoid }} -j RETURN -A PREROUTING --in-interface {{ ansible_default_ipv4['interface'] }} -p udp --dport {{ wireguard_port_avoid }} -j REDIRECT --to-port {{ wireguard_port_actual }} {% endif %} # Allow traffic from the VPN network to the outside world, and replies diff --git a/roles/common/templates/rules.v6.j2 b/roles/common/templates/rules.v6.j2 index 96642a7..3753d60 100644 --- a/roles/common/templates/rules.v6.j2 +++ b/roles/common/templates/rules.v6.j2 @@ -31,6 +31,7 @@ COMMIT {% if wireguard_enabled and wireguard_port|int == wireguard_port_avoid|int %} # Handle the special case of allowing access to WireGuard over an already used # port like 53 +-A PREROUTING -s {{ subnets|join(',') }} -p udp --dport {{ wireguard_port_avoid }} -j RETURN -A PREROUTING --in-interface {{ ansible_default_ipv6['interface'] }} -p udp --dport {{ wireguard_port_avoid }} -j REDIRECT --to-port {{ wireguard_port_actual }} {% endif %} # Allow traffic from the VPN network to the outside world, and replies