0

I have a wireguard network in which I want a "host" peer to forward some traffic to multiple network cameras in its local network. Said peer registers several IPs, and I want to use nftables to route traffic to a specific camera based on which of its IP is being accessed, as if the cameras themselves were on the wireguard network.

The reduced wireguard conf looks like this;

[Interface]
PrivateKey = [REDACTED]
Address = 10.10.0.1/24, 10.10.0.150/32, 10.10.0.151/32, 10.10.0.152/32, 10.10.0.153/32, 10.10.0.154/32 # ...

I then use nftables to set up the routing.

table ip filter {
    chain input {
        type filter hook input priority filter; policy accept;
        # various rules...
    }

    chain forward {
        type filter hook forward priority filter; policy accept;
        ct status dnat accept
        iifname "wg0" accept
        oifname "wg0" accept
    }
}
        
table ip nat {
    chain prerouting {
        type nat hook prerouting priority 0;
        ip daddr 10.10.0.150 iifname "wg0" tcp dport 80 dnat to 10.0.1.150
        ip daddr 10.10.0.151 iifname "wg0" tcp dport 80 dnat to 10.0.1.151
        ip daddr 10.10.0.152 iifname "wg0" tcp dport 80 dnat to 10.0.1.152
        ip daddr 10.10.0.153 iifname "wg0" tcp dport 80 dnat to 10.0.1.153
        ip daddr 10.10.0.154 iifname "wg0" tcp dport 80 dnat to 10.0.1.154
    }

    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
        oifname "eth0" masquerade
    }
}

I want to simplify the copy/pasting in the prerouting chain by use of maps, but I can't figure out how to actually use them. The documentation1 gives some short examples but I still don't understand it.

I can define a map easily enough;

define cameras = { \
        10.10.0.150 : 10.0.1.150, \
        10.10.0.151 : 10.0.1.151, \
        10.10.0.152 : 10.0.1.152, \
        10.10.0.153 : 10.0.1.153, \
        10.10.0.154 : 10.0.1.154, \
}

But how do I actually apply it into a ip daddr {} iifname "wg0" tcp dport 80 dnat to {} expression?

2
  • Before doing an answer about the question, I'm wondering why you are doing NAT at all? Since all these addresses are private addresses and under your control, why don't you simply configure the "host peer" (as well as its wireguard interface) to route 10.0.1.0/24 without any NAT? Also note that nftables (or iptables) doesn't route. Doing NAT merely changes the addresses and thus the routing stack's routing decision.
    – A.B
    Commented Mar 13, 2023 at 22:24
  • It's very possible I can do this without NAT and I just don't know enough. The peer and the cameras are behind a commercial router, and the cameras themselves don't have the ability to run wireguard. Other peers are other computes geographically elsewhere behind their own routers, and phones and tablets. Don't I need NAT to expose the local-network cameras to the wireguard network via the peer? As for the syntax, ChatGPT helepd me express it iwth a map, but now I'm curious if I can do as you say and manage without the dnat.
    – zorael
    Commented Mar 16, 2023 at 8:26

0

You must log in to answer this question.

Browse other questions tagged .