I run a server with a web server running as a rootless podman container. This exposes ports 10080 and 10443 because, as a rootless container, it is not allowed to expose ports 80 and 443.
So that my website can be accessed from outside, I use ufw as a firewall and have set up port forwarding there. To do this, I added the following lines to the beginning of the
*nat :PREROUTING ACCEPT [0:0] -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10080 -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 10443 COMMIT
So far everything works.
I now want to run another container that runs a Wireguard server. This outputs the following in its log and seems to set this as rules in the firewall:
[#] ip link add wg0 type wireguard [#] wg setconf wg0 /dev/fd/63 [#] ip -4 address add 10.13.13.1 dev wg0 [#] ip link set mtu 1420 up dev wg0 [#] ip -4 route add 10.13.13.2/32 dev wg0 [#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
If I run the Wireguard container without the ufw firewall activated - especially without the defined port forwarding - everything works. I can connect with a client and its traffic is routed through the tunnel and reaches the Internet.
If, on the other hand, I activate the ufw firewall including the defined port forwarding and then connect to the Wireguard VPN with a client, then all page views seem to reach my server itself - at least I get error messages like this:
This server could not prove that it is www.google.de. Its security certificate comes from <myServer>.de
How can I configure the ufw firewall so that
- Requests from outside to port 80 or 443 are forwarded to ports 10080 or 10443 and thus reach my web server
- Requests from my vpn-client reach the Internet via the WireGuard tunnel and not my own server?
(On another server I run the WebServer and WireGuard both under docker - everything works because the Docker WebServer directly exposes ports 80 and 443 and therefore I don't need any port forwarding.)
Many thanks for your help.