Score:0

Isolating two WireGuard subnets

eg flag

On an AWS server I am hosting a WireGuard peer with two WireGuard interfaces:

  • wg0 - 10.0.1.0/24
  • wg1 - 10.0.2.0/24

There are two groups of clients connecting to the same AWS server but with different target WireGuard interfaces. At the moment, a PC connecting to wg0 can ping a client on the subnet of wg1 10.0.2.0/24.

I would like to block any access in between the two subnets, such that any client connecting to wg0 will not talk to clients on wg1.

I tried to add iptables rules and have the below

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-A FORWARD -i wg1 -o wg0 -j DROP
-A FORWARD -i wg0 -o wg1 -j DROP
-A FORWARD -s 10.0.1.0/24 -d 10.0.2.0/24 -j DROP
-A FORWARD -s 10.0.2.0/24 -d 10.0.1.0/24 -j DROP
-A FORWARD -i wg1 -j ACCEPT
-A FORWARD -i wg0 -j ACCEPT

However, I can still ping from a client on wg0 the clients on wg1 with the above. What may be also needed to implement the block?

I tried to disable net.ipv4.ip_forward, but the access was still possible.

Mariusz Zieliński avatar
us flag
What do you have in "nat" and "mangle" tables ?
Sandbo avatar
eg flag
Sorry, it was my mistake and the above is indeed working. Please see my answer below.
Score:0
eg flag

Sorry, just want to update that the above lines are actually working. and I was only not noticing it, as I forgot to setup routing on my PC to 10.0.2.0/.24 to begin with. If routing wasn't set, somehow pinging form 10.0.1.8 (my PC) to many address in 10.0.2.0/24 will not result in packet loss even there isn't a client at that 10.0.2.0/24 address.

Then I tested by actually making sure the routing between 10.0.1.0/24 and 10.0.2.0/24 is working with my PC and a minecraft server, setting the above indeed then blocked it.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.