87 lines
2.3 KiB
Plaintext
87 lines
2.3 KiB
Plaintext
|
title: Firewall magic with nftables: how to redirect all ports to one port
|
||
|
---
|
||
|
pub_date: 2019-11-07
|
||
|
---
|
||
|
author: ungleich
|
||
|
---
|
||
|
twitter_handle: ungleich
|
||
|
---
|
||
|
_hidden: yes
|
||
|
---
|
||
|
_discoverable: no
|
||
|
---
|
||
|
abstract:
|
||
|
How to redirect traffic from all (tcp/udp) ports to another port.
|
||
|
And why one would want to do that...
|
||
|
---
|
||
|
body:
|
||
|
|
||
|
## The problem
|
||
|
|
||
|
Let's say you have a service running on a specific port, for instance
|
||
|
[wireguard](https://www.wireguard.com/) on **port 51820**, but you
|
||
|
would like to accept packets on **any** port and have it received by
|
||
|
your application.
|
||
|
|
||
|
As you might know we are [big fans of
|
||
|
nftables](https://ungleich.ch/de/cms/ungleich-blog/2018/08/19/iptables-vs-nftables/),
|
||
|
so we will use nftables to achieve this goal.
|
||
|
|
||
|
## Why would one want this?
|
||
|
|
||
|
There are a variety of reasons for doing this, including the
|
||
|
"because we can" case. However at
|
||
|
[ungleich](https://ungleich.ch) we have a real world use case: We
|
||
|
provide an [IPv6 VPN](https://ipv6vpn.ch) as a service to our
|
||
|
customers. This service is based on wireguard and is configured to
|
||
|
listen on port 51820.
|
||
|
|
||
|
Sometimes networks (like hotels or airports) block or filter
|
||
|
outgoing traffic and thus prevent our customers to be connected by
|
||
|
IPv6. Obviously this is not what we or our customers want.
|
||
|
|
||
|
Typically these networks will still allow outgoing traffic on
|
||
|
*some ports*, but we don't know *which ports*.
|
||
|
Thus we will enable wireguard on *all ports*. Simple idea, isn't it?
|
||
|
|
||
|
## How it works
|
||
|
|
||
|
To achieve our goal we need to tell nftables to take the traffic that
|
||
|
goes to any port that is not our target port, to be redirected to our
|
||
|
target part. If you have other services running on the host, you might
|
||
|
want to adjust this logic.
|
||
|
|
||
|
In nftables we have a lot of freedom naming and creating our own
|
||
|
chains
|
||
|
|
||
|
TO FIX HERE
|
||
|
|
||
|
ALSO maybe include only incoming packets modification or is it part of prerouting?!
|
||
|
|
||
|
```
|
||
|
table ip nat {
|
||
|
chain prerouting {
|
||
|
type nat hook prerouting priority filter; policy accept;
|
||
|
udp dport != 51820 jump vpnredirect
|
||
|
}
|
||
|
|
||
|
chain postrouting {
|
||
|
type nat hook postrouting priority srcnat; policy accept;
|
||
|
}
|
||
|
|
||
|
chain vpnredirect {
|
||
|
udp dport != 51820 redirect to :51820
|
||
|
}
|
||
|
}
|
||
|
```
|
||
|
|
||
|
|
||
|
## Other programs!
|
||
|
|
||
|
|
||
|
## List of sites
|
||
|
|
||
|
You find the current list of sites on
|
||
|
[via-ipv6.com](https://via-ipv6.com). If you would like to have
|
||
|
another site added, just ping me on [IPv6.chat](https://IPv6.chat).
|