search

WireGuard / wireguard-vyatta-ubnt

WireGuard for Ubiquiti Devices
https://www.wireguard.com/
GNU General Public License v3.0
1.46k stars 68 forks source link

Following example config on ER-X leaves firewall rule allowing only invalid packets #93

Open dasrue opened 3 years ago

dasrue commented 3 years ago

I just followed the example configuration, on 2 different Edgerouter X's and found the same behaviour if you copy and paste the example configuration from the readme.md. The firewall rule seems to get generated with only the allow invalid box ticked. A solution could be to update the readme to include:

set firewall name WAN_LOCAL rule 20 state established enable
set firewall name WAN_LOCAL rule 20 state new enable
set firewall name WAN_LOCAL rule 20 state related enable

after set firewall name WAN_LOCAL rule 20 destination port 51820.

dc361 commented 2 years ago

Good catch - the rules you mention would be necessary on an edgerouter initiating a peer connection and the rules in the readme.md work fine for listening for a peer.