Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add UFW configuration to the wireguard internal docs #1205

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
+25 −0
Open

Add UFW configuration to the wireguard internal docs #1205

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b7b3c8f
Add UFW configuration to the wireguard internal docs
Beagon Mar 10, 2025
feac848
Add the correct spacings and remove trailing spaces #2512
Beagon Mar 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions docs/guides/vpn/wireguard/internal.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,31 @@ The rules will then be cleared once the tunnel is down.

The important change is the extra `PostUp` and `PostDown` in the `[Interface]` section.
<!-- markdownlint-enable code-block-style -->

### `ufw`

If you are using UFW the above doesn't work and you will need to edit `/etc/ufw/before.rules`:

Insert this into the before.rules file but **before** the FIRST commit line:

```bash
# allow forwarding for trusted network
-A ufw-before-forward -s 10.10.10.0/24 -j ACCEPT
-A ufw-before-forward -d 10.10.10.0/24 -j ACCEPT
```

For IPv6 you need to do the same but at `/etc/ufw/before6.rules`:

Put the following near the bottom but **before** the first COMMIT line:

```bash
# allow forwarding for trusted network
-A ufw6-before-forward -s fd08:4711::/64 -j ACCEPT
-A ufw6-before-forward -d fd08:4711::/64 -j ACCEPT
```

Restart ufw for the changes to take effect: `systemctl restart ufw`

## Allow clients to access other devices

In our standard configuration, we have configured the clients in such a way that they can only speak to the server. Add the network range of your local network in CIDR notation (e.g., `192.168.2.1 - 192.168.2.254` -> `192.168.2.0/24`) in the `[Peers]` section of all clients you want to have this feature:
Expand Down