Port forward from wan to wireguard

Installing and Using OpenWrt Network and Wireless Configuration
1

I am unable to get port forwarding working from WAN to Wireguard. It works if I try to forward to a LAN host.

I am able to connect from a LAN host to any host on the Wireguard VPN.

See images attached. This works if I replace the IP 192.168.11.3, which is a host on my Wireguard VPN, with a LAN host (given it has port 22 open).

swappy-20240910_130928
swappy-20240910_130928558×671 30 KB

swappy-20240910_131011
swappy-20240910_1310111068×707 42 KB

2

Very likely incoming mssql is blocked by your provider

3

It is not. I checked with nmap -p 1433 portquiz.net

I can also reach the host on wireguard directly from the router over the console (ssh).

4

I was implying other way around. Just make full wireguard dial-in and all will work.

1 Like
5

how is it related ?
portquiz.net is ...

image
image927×138 8.7 KB

1 Like
6

1433 is not blocked outgoing from the remote source, nor from my ISP.

I got it working with a workaround, in the router (OpenWRT) I did:

socat tcp-listen:1433,reuseaddr,fork tcp:192.168.11.3:22

Then I was able to ssh into 192.168.11.3 from a remote destionation.

I of course altered the forwarding rule. But it would be great to not utilise this "hack".

7

I thought he meant the other way around, I read it to quick.

8

You could use something like this:
iptables -t nat -A INPUT -p tcp --dport 1433 -j DNAT --to-destination 192.168.11.3:22

1 Like
9

Or add "internal IP address" in dnat rule to use that in place of own ip

1 Like
10

Seems like my screenshot above did not reflect my question, I guess I experimented with something.

Anyway, I have tried that. And it does not work :confused: In the windows titled "Firewall - Port Forwards - ssh 1433 to home" it is supposed to say 192.168.11.3, and not any.

1 Like
11

I am not used to use iptables on OpenWRT. I have usually used luci. Does this setting persist? And can I specify the same using luci?

12

This is the same as if you would click on the word "any" in the address and type it manually.

13

Yes - port rule, type dnat source zone where 1433 should be listening, forward address +ip shows destination. zone not needed for destination.

14

Like so?

swappy-20240910_145925
swappy-20240910_145925512×638 28.9 KB

15

Seems like iptables is not installed on my OpenWRT.

16

Lets start with the basics.

Please connect to your OpenWRT device using ssh and copy the output of the following commands and post it here using the "Preformatted text </> " button:

Remember to redact keys, passwords, MAC addresses and any public IP addresses you may have:

ubus call system board
cat /etc/config/network
cat /etc/config/dhcp
cat /etc/config/firewall
ip route show
wg show
17

OpenWrt uses nftables now. But you don't have to worry about that because fw4 can handle this forward at a higher level.

It is required to specify a destination zone and internal IP for a port forward to work. It is a config redirect not a config rule. I'm not sure what those look like in the GUI.

18

Again, I am sorry for the first screenshots. They did not reflect the state. See attached updated screenshots:

swappy-20240910_150924
swappy-20240910_150924902×626 36 KB

swappy-20240910_150906
swappy-20240910_150906482×583 25.7 KB

So on the NAT I do have a dest zone and rule

19

Add dest address, empty means incoming interface

20

@mk24 in config-form:

config rule
        option target 'ACCEPT'
        option proto 'tcp'
        option src 'wan'
        option dest '*'
        option dest_port '1433'
        option name 'Allow 1433 on WAN to FWD'

config redirect
        option dest 'home'
        option target 'DNAT'
        option name 'ssh 1433 to home'
        list proto 'tcp'
        option src 'wan'
        option src_dport '1433'
        option dest_port '22'
        option family 'ipv4'
        option dest_ip '192.168.11.3'
1 Like