[SOLVED] UFW and WireGuard not working together

[tnull]

Hi, I've been trying to fix this for several days. I don't think its specific to Gentoo, but I am using Gentoo so here I am.

I'm using an external VPN service (Mullvad). When UFW is enabled, I can connect to the VPN through network manager, but I have no internet access. If I disable UFW, I also get no internet access, but if I reboot after disabling UFW it will work as expected. I've tried several combinations of rules to allow incoming / outgoing connections on the WireGuard interface to no avail.

My question is: What exactly is UFW doing that it would continue to block it even when disabled? It only works if I reboot after disabling it.
This leads me to believe that it wouldn't really matter which rules I use since UFW is clearly doing something under the hood that blocks it regardless of status.

Any insight is appreciated, thanks.

[pietinger]

tnull,

Welcome to Gentoo Forums.

UFW is an Uncomplicated FireWall. See more in our Wiki: https://wiki.gentoo.org/wiki/Ufw

A problem with uncomplicated things is, it doesnt help if someone dont know what it does ... UFW is NOT your firewall; it helps you only to set some rules for your firewall. Your real firewall is in your kernel (as modules). These modules must be configured with "iptables" or "nftables". UFW uses one of these commands to send fw-rules to your kernel-modules. If your UFW is using "iptables" you can list all active rules with "iptables -L" (better: "iptables -L -v -n").

In my opinion it is easier for everyone who has "specific" network "solutions" (like a VPN) to do native firewalling with "iptables" or "nftables". If you understand which ports must be allowed you can play with UFW later (or throw it away forever). Maybe you want read an old article -> chapter II. of: https://forums.gentoo.org/viewtopic-p-8612346.html (here is a link to my german article which is updated).

Most important when doing firewalling is Logging ! It is very helpful to see what is blocked/forbidden - and it is necessary to recognize bad requests. If you need more help we need first a short description of your system:
1. OpenRC or systemd ? Stable or ~amd64 ?
2. Output of "dmesg".
3. How do you installed and configured UFW ?

[tnull]

pietinger,
Thank you for the informative post. After reading through your links, I decided I would ditch ufw and just try to configure iptables myself since I have a simple use-case. I went with the following basic rules to get started with:

[pietinger]

tnull,

I am glad it works for you So, you have one rule (and 3 defaults) and this is sufficient to prevent your host from incoming traffic. Of course I must recommend to filter outgoing traffic also ... But one after another; I am sure you will get it.

Have fun with Gentoo !