Port forward from Wireguard interface not working

Installing and Using OpenWrt Network and Wireless Configuration
1

I recently set up a WireGuard interface on an OpenWrt router to connect it with 44net which exposes it as a public IP address.

And it seems to be working. Too well in fact, because for a moment my LuCI login page was exposed publicly because I guess LuCI lisens on all interfaces!

So I set up a firewall zone over the WireGuard connection:

config zone
	option name 'wg'
	option input 'REJECT'
	option output 'ACCEPT'
	option forward 'REJECT'
	list network 'frist44'

But then I wanted to expose just a single service on my internal network via a Port Forward, so I added this rule (via the web UI):

config redirect
	option target 'DNAT'
	option src 'wg'
	option src_dport '9900'
	option dest_ip '192.168.11.42'
	option dest_port '9000'
	option reflection '0'

It does seem to have some effect as now when I curl -v 44.x.x.x:9900 instead of "Couldn't connect to server" it now just hangs indefinitely trying.

I confirmed that from the OpenWrt box where the port forward is set up I can wget -O - http://192.168.11.42:9000 and it works fine directly. But through the port forward no connection appears to be made to the destination IP/port, even though as I said the OpenWrt box does seem to now be listening on the source port.

Any idea what's going on, and what might I do to troubleshoot this?

2

It is likely that your port forward is actually reaching the destination host, but then the response is being routed incorrectly (out the wan instead of the VPN) and then lost.

We often see this as the culprit for when a user has a public IP on the wan with a port forward and a VPN for routing all of their normal traffic (for geographic//privacy/censorship type reasons) -- the response traffic in that case gets routed out the VPN instead of the wan... same situation, just reversed from your use case.

With that in mind, the solution is policy based routing.