I need help with the Firewall on my homelab server. I’ve been trying to set up a port forward that forwards traffic from 10.0.0.1:3000
to 192.168.122.2:3000
. Specifically, the 10.0.0.1
host is the other end of a Wireguard tunnel whose interface is named VPS_Tunnel
. It’s on the 10.0.0.0/30
subnet. The other IP address is the address of a libvirt guest using the default libvirt network. My homelab server runs RHEL, so I’ve been trying to accomplish this with Firewalld to no avail. Then I’ve messed with IPTables directly, and I haven’t seemed to locked myself out so I guess that’s a good thing, but it’s really sketchy for me messing with IPTables since I am generally less familiar with it than I am with Firewalld. Idk if this is of any use:
~ # iptables -L -n -v --line-numbers 130 ↵ root@GlaedrServer
Chain INPUT (policy ACCEPT 110K packets, 9027K bytes)
num pkts bytes target prot opt in out source destination
1 110K 9030K LIBVIRT_INP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 107 19235 LIBVIRT_FWX all -- * * 0.0.0.0/0 0.0.0.0/0
2 107 19235 LIBVIRT_FWI all -- * * 0.0.0.0/0 0.0.0.0/0
3 53 7187 LIBVIRT_FWO all -- * * 0.0.0.0/0 0.0.0.0/0
4 0 0 ACCEPT tcp -- VPS_Tunnel virbr0 0.0.0.0/0 0.0.0.0/0 tcp dpt:3000
5 0 0 ACCEPT tcp -- virbr0 VPS_Tunnel 0.0.0.0/0 0.0.0.0/0 tcp spt:3000 state RELATED,ESTABLISHED
Chain OUTPUT (policy ACCEPT 127K packets, 21M bytes)
num pkts bytes target prot opt in out source destination
1 127K 21M LIBVIRT_OUT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain LIBVIRT_FWI (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all -- * virbr1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
2 54 12048 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED
3 0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain LIBVIRT_FWO (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all -- virbr1 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
2 53 7187 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0
3 0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain LIBVIRT_FWX (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- virbr1 virbr1 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0
Chain LIBVIRT_INP (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
2 0 0 ACCEPT tcp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
3 0 0 ACCEPT udp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
4 0 0 ACCEPT tcp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
5 33 2348 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
6 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
7 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
8 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
Chain LIBVIRT_OUT (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- * virbr1 0.0.0.0/0 0.0.0.0/0 udp dpt:53
2 0 0 ACCEPT tcp -- * virbr1 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
3 0 0 ACCEPT udp -- * virbr1 0.0.0.0/0 0.0.0.0/0 udp dpt:68
4 0 0 ACCEPT tcp -- * virbr1 0.0.0.0/0 0.0.0.0/0 tcp dpt:68
5 0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:53
6 0 0 ACCEPT tcp -- * virbr0 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
7 0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:68
8 0 0 ACCEPT tcp -- * virbr0 0.0.0.0/0 0.0.0.0/0 tcp dpt:68