Wireguard, PBR and Killswitch: connection does not work but I can ping servers

MatteoDXB · August 12, 2023, 8:37pm

I have implemented a wireguard VPN towards an external server, leveraging PBR to route the traffic:

192.168.1.1/24: towards the wan
192.168.2.1/24: towards the wireguard

I have enabled already the strict enforcement in the PBR, however, if I stop the wireguard interface, I can't browse the Internet via devices connected to 192.168.2.x/24, but I can ping any server via CLI from devices on the 192.168.2.1/24.

How can I implement a kill switch that totally stop any connection on the 192.168.2.1/24 if the WG server is down, allowing the 192.168.1.1/24 to continue browsing?

Firewall:

root@OpenWrt:~# cat /etc/config/firewall

config defaults
       option input 'ACCEPT'
       option output 'ACCEPT'
       option forward 'REJECT'
       option synflood_protect '1'

config zone
       option name 'lan'
       option input 'ACCEPT'
       option output 'ACCEPT'
       option forward 'ACCEPT'
       list network 'intsw'
       list network 'lan'

config zone
       option name 'wan'
       list network 'wan'
       list network 'wan6'
       option input 'REJECT'
       option output 'ACCEPT'
       option forward 'REJECT'
       option masq '1'
       option mtu_fix '1'
       list device 'wg0'
       list device 'wg+'

config rule
       option name 'Allow-DHCP-Renew'
       option src 'wan'
       option proto 'udp'
       option dest_port '68'
       option target 'ACCEPT'
       option family 'ipv4'

config rule
       option name 'Allow-Ping'
       option src 'wan'
       option proto 'icmp'
       option icmp_type 'echo-request'
       option family 'ipv4'
       option target 'ACCEPT'

config rule
       option name 'Allow-IGMP'
       option src 'wan'
       option proto 'igmp'
       option family 'ipv4'
       option target 'ACCEPT'

config rule
       option name 'Allow-DHCPv6'
       option src 'wan'
       option proto 'udp'
       option dest_port '546'
       option family 'ipv6'
       option target 'ACCEPT'

config rule
       option name 'Allow-MLD'
       option src 'wan'
       option proto 'icmp'
       option src_ip 'fe80::/10'
       list icmp_type '130/0'
       list icmp_type '131/0'
       list icmp_type '132/0'
       list icmp_type '143/0'
       option family 'ipv6'
       option target 'ACCEPT'

config rule
       option name 'Allow-ICMPv6-Input'
       option src 'wan'
       option proto 'icmp'
       list icmp_type 'echo-request'
       list icmp_type 'echo-reply'
       list icmp_type 'destination-unreachable'
       list icmp_type 'packet-too-big'
       list icmp_type 'time-exceeded'
       list icmp_type 'bad-header'
       list icmp_type 'unknown-header-type'
       list icmp_type 'router-solicitation'
       list icmp_type 'neighbour-solicitation'
       list icmp_type 'router-advertisement'
       list icmp_type 'neighbour-advertisement'
       option limit '1000/sec'
       option family 'ipv6'
       option target 'ACCEPT'

config rule
       option name 'Allow-ICMPv6-Forward'
       option src 'wan'
       option dest '*'
       option proto 'icmp'
       list icmp_type 'echo-request'
       list icmp_type 'echo-reply'
       list icmp_type 'destination-unreachable'
       list icmp_type 'packet-too-big'
       list icmp_type 'time-exceeded'
       list icmp_type 'bad-header'
       list icmp_type 'unknown-header-type'
       option limit '1000/sec'
       option family 'ipv6'
       option target 'ACCEPT'

config rule
       option name 'Allow-IPSec-ESP'
       option src 'wan'
       option dest 'lan'
       option proto 'esp'
       option target 'ACCEPT'

config rule
       option name 'Allow-ISAKMP'
       option src 'wan'
       option dest 'lan'
       option dest_port '500'
       option proto 'udp'
       option target 'ACCEPT'

config rule
       option name 'FWSW1'
       list src_ip '192.168.2.1/24'
       list dest_ip '192.168.1.1/24'
       option target 'REJECT'
       option dest '*'
       list proto 'all'
       option src '*'

config rule
       option dest '*'
       option target 'REJECT'
       option name 'FWSW2'
       list proto 'all'
       list src_ip '192.168.2.1/24'
       list dest_ip '192.168.1.1/24'

config rule
       option name 'FWSW3'
       list proto 'all'
       option src '*'
       list src_ip '192.168.1.1/24'
       option dest '*'
       list dest_ip '192.168.2.1/24'
       option target 'REJECT'

config rule
       option name 'FWSW4'
       list proto 'all'
       list src_ip '192.168.1.1/24'
       option dest '*'
       list dest_ip '192.168.2.1/24'
       option target 'REJECT'

config zone
       option name 'Wg0Swiss'
       option input 'REJECT'
       option output 'ACCEPT'
       option forward 'REJECT'
       option masq '1'
       option mtu_fix '1'
       list network 'intsw'
       list network 'wg0'

config forwarding
       option src 'Wg0Swiss'
       option dest 'wan'

config forwarding
       option src 'lan'
       option dest 'wan'

Network

root@OpenWrt:~# cat /etc/config/network

config interface 'loopback'
        option device 'lo'
        option proto 'static'
        option ipaddr '127.0.0.1'
        option netmask '255.0.0.0'

config globals 'globals'
        option packet_steering '1'
        option ula_prefix 'EDIT'

config device
        option name 'br-lan'
        option type 'bridge'
        list ports 'lan2'
        list ports 'lan3'
        list ports 'lan4'

config interface 'lan'
        option device 'br-lan'
        option proto 'static'
        option ipaddr '192.168.1.1'
        option netmask '255.255.255.0'
        option ip6assign '60'

config interface 'wan'
        option device 'wan'
        option proto 'dhcp'
        option peerdns '0'
        list dns '1.1.1.1'
        list dns '1.0.0.1'
        option metric '100'

config interface 'wan6'
        option device 'wan'
        option proto 'dhcpv6'

config interface 'wg0'
        option proto 'wireguard'
        option private_key 'EDIT'
        list addresses '10.66.66.2/32'
        list addresses 'fd42:42:42::2/128'
        list dns '1.1.1.1'
        list dns '1.0.0.1'
        option metric '10'

config wireguard_wg0
        option description 'EDIT'
        option public_key 'EDIT'
        option preshared_key 'EDIT'
        list allowed_ips '0.0.0.0/0'
        list allowed_ips '::/0'
        option endpoint_host 'EDIT'
        option endpoint_port '7500'
        option persistent_keepalive '25'

config device
        option type 'bridge'
        option name 'br-sw'
        list ports 'lan1'
        list ports 'wlan1-2'

config interface 'intsw'
        option proto 'static'
        option device 'br-sw'
        option ipaddr '192.168.2.1'
        option netmask '255.255.255.0'

egc · August 13, 2023, 6:15am

It is very early and I did not had my morning coffee yet but it looks like you made a separate firewall zone for the wg0 interface (WG0swiss)

If so so than delete the wg0 and wg+ from the WAN zone?

MatteoDXB:

config zone
       option name 'wan'
       list network 'wan'
       list network 'wan6'
       option input 'REJECT'
       option output 'ACCEPT'
       option forward 'REJECT'
       option masq '1'
       option mtu_fix '1'
       list device 'wg0'   <<<<<<<
       list device 'wg+'  <<<<<<<

MatteoDXB · August 13, 2023, 7:13am

I wish you will have a wonderful weekend and thank you for help even early morning
You are correct, I created a separate zone, and I have the interface wg0 for wireguard, and the intsw to allow the pbr to work.
I tried to remove the wg0 and wg+ from wan, but if I do, when I connect to the 192.168.2.1/24, even if the wireguard is on, I can't browse the internet.

vgaetera · August 13, 2023, 7:30am

Add a separate zone for the intsw network.
Add a forwarding from this zone to the Wg0Swiss zone.

MatteoDXB · August 13, 2023, 7:42am

After many trials, this below seems to work. From the machine on the 192.168.2.1/24 I can't browse the internet or ping anyone on the net if the wg0 is down.

I can ping the machines on the internet from the router, but i guess it's because the router has also the wan connection.

root@OpenWrt:~# cat /etc/config/firewall

config defaults
        option input 'ACCEPT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option synflood_protect '1'

config zone
        option name 'lan'
        option input 'ACCEPT'
        option output 'ACCEPT'
        list network 'lan'
        option forward 'ACCEPT'

config zone
        option name 'wan'
        list network 'wan'
        list network 'wan6'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'

config rule
       option name 'Allow-DHCP-Renew'
       option src 'wan'
       option proto 'udp'
       option dest_port '68'
       option target 'ACCEPT'
       option family 'ipv4'

config rule
       option name 'Allow-Ping'
       option src 'wan'
       option proto 'icmp'
       option icmp_type 'echo-request'
       option family 'ipv4'
       option target 'ACCEPT'

config rule
       option name 'Allow-IGMP'
       option src 'wan'
       option proto 'igmp'
       option family 'ipv4'
       option target 'ACCEPT'

config rule
       option name 'Allow-DHCPv6'
       option src 'wan'
       option proto 'udp'
       option dest_port '546'
       option family 'ipv6'
       option target 'ACCEPT'

config rule
       option name 'Allow-MLD'
       option src 'wan'
       option proto 'icmp'
       option src_ip 'fe80::/10'
       list icmp_type '130/0'
       list icmp_type '131/0'
       list icmp_type '132/0'
       list icmp_type '143/0'
       option family 'ipv6'
       option target 'ACCEPT'

config rule
       option name 'Allow-ICMPv6-Input'
       option src 'wan'
       option proto 'icmp'
       list icmp_type 'echo-request'
       list icmp_type 'echo-reply'
       list icmp_type 'destination-unreachable'
       list icmp_type 'packet-too-big'
       list icmp_type 'time-exceeded'
       list icmp_type 'bad-header'
       list icmp_type 'unknown-header-type'
       list icmp_type 'router-solicitation'
       list icmp_type 'neighbour-solicitation'
       list icmp_type 'router-advertisement'
       list icmp_type 'neighbour-advertisement'
       option limit '1000/sec'
       option family 'ipv6'
       option target 'ACCEPT'

config rule
       option name 'Allow-ICMPv6-Forward'
       option src 'wan'
       option dest '*'
       option proto 'icmp'
       list icmp_type 'echo-request'
       list icmp_type 'echo-reply'
       list icmp_type 'destination-unreachable'
       list icmp_type 'packet-too-big'
       list icmp_type 'time-exceeded'
       list icmp_type 'bad-header'
       list icmp_type 'unknown-header-type'
       option limit '1000/sec'
       option family 'ipv6'
       option target 'ACCEPT'

config rule
       option name 'Allow-IPSec-ESP'
       option src 'wan'
       option dest 'lan'
       option proto 'esp'
       option target 'ACCEPT'

config rule
       option name 'Allow-ISAKMP'
       option src 'wan'
       option dest 'lan'
       option dest_port '500'
       option proto 'udp'
       option target 'ACCEPT'

config zone
        option name 'Wg0Swiss'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'
        option masq '1'
        option mtu_fix '1'
        list network 'wg0'

config forwarding
        option src 'Wg0Swiss'
        option dest 'wan'

config forwarding
        option src 'lan'
        option dest 'wan'

config zone
        option name 'FWIntSw'
        option output 'ACCEPT'
        list network 'intsw'
        option forward 'REJECT'
        option input 'ACCEPT'

config forwarding
        option src 'FWIntSw'
        option dest 'Wg0Swiss'
root@OpenWrt:~#

system · August 23, 2023, 7:43am

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.