How to define port forwarding

Question

I run a server with a web server running as a rootless podman container. This exposes ports 10080 and 10443 because, as a rootless container, it is not allowed to expose ports 80 and 443.

So that my website can be accessed from outside, I use ufw as a firewall and have set up port forwarding there. To do this, I added the following lines to the beginning of the /etc/ufw/before.rules file:

*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10080
-A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 10443
COMMIT

So far everything works.

I now want to run another container that runs a Wireguard server. This outputs the following in its log and seems to set this as rules in the firewall:

[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.13.13.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 10.13.13.2/32 dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE

If I run the Wireguard container without the ufw firewall activated - especially without the defined port forwarding - everything works. I can connect with a client and its traffic is routed through the tunnel and reaches the Internet.

If, on the other hand, I activate the ufw firewall including the defined port forwarding and then connect to the Wireguard VPN with a client, then all page views seem to reach my server itself - at least I get error messages like this:

This server could not prove that it is www.google.de. Its security certificate comes from <myServer>.de

How can I configure the ufw firewall so that

1. Requests from outside to port 80 or 443 are forwarded to ports 10080 or 10443 and thus reach my web server
2. Requests from my vpn-client reach the Internet via the WireGuard tunnel and not my own server?

(On another server I run the WebServer and WireGuard both under docker - everything works because the Docker WebServer directly exposes ports 80 and 443 and therefore I don't need any port forwarding.)

Many thanks for your help.

Answer 1

After rethinking solution is simple: just do the port forwarding only when destination is my servers IP, so I changed before.rules to:

*nat
:PREROUTING ACCEPT [0:0]
-A PREROUTING -d <ServerIP> -p tcp --dport 80 -j REDIRECT --to-port 10080
-A PREROUTING -d <ServerIP> -p tcp --dport 443 -j REDIRECT --to-port 10443
COMMIT