From 97de49daa3f89c9e71069b161c8df1ee35d40758 Mon Sep 17 00:00:00 2001 From: "David E. Myers" Date: Tue, 4 Feb 2020 16:59:00 -0500 Subject: [PATCH] Fix IPsec DNS when WireGuard uses port 53 --- roles/common/templates/rules.v4.j2 | 1 + roles/common/templates/rules.v6.j2 | 1 + 2 files changed, 2 insertions(+) diff --git a/roles/common/templates/rules.v4.j2 b/roles/common/templates/rules.v4.j2 index 764008a..022afdf 100644 --- a/roles/common/templates/rules.v4.j2 +++ b/roles/common/templates/rules.v4.j2 @@ -32,6 +32,7 @@ COMMIT {% if wireguard_enabled and wireguard_port|int == wireguard_port_avoid|int %} # Handle the special case of allowing access to WireGuard over an already used # port like 53 +-A PREROUTING -s {{ subnets|join(',') }} -p udp --dport {{ wireguard_port_avoid }} -j ACCEPT -A PREROUTING --in-interface {{ ansible_default_ipv4['interface'] }} -p udp --dport {{ wireguard_port_avoid }} -j REDIRECT --to-port {{ wireguard_port_actual }} {% endif %} # Allow traffic from the VPN network to the outside world, and replies diff --git a/roles/common/templates/rules.v6.j2 b/roles/common/templates/rules.v6.j2 index 96642a7..6968acf 100644 --- a/roles/common/templates/rules.v6.j2 +++ b/roles/common/templates/rules.v6.j2 @@ -31,6 +31,7 @@ COMMIT {% if wireguard_enabled and wireguard_port|int == wireguard_port_avoid|int %} # Handle the special case of allowing access to WireGuard over an already used # port like 53 +-A PREROUTING -s {{ subnets|join(',') }} -p udp --dport {{ wireguard_port_avoid }} -j ACCEPT -A PREROUTING --in-interface {{ ansible_default_ipv6['interface'] }} -p udp --dport {{ wireguard_port_avoid }} -j REDIRECT --to-port {{ wireguard_port_actual }} {% endif %} # Allow traffic from the VPN network to the outside world, and replies