What is the purpose of the premangle and postmangle chains created by wg-quick(8)? Is it to ensure that rogue packets cannot bypass stateful firewall rules?
More precisely, I am using wg-quick in a Qubes VM. I want all traffic on vif interfaces to go through WireGuard, which will ultimately send the packets on eth0. All incoming traffic on eth0 that is not protected by WireGuard should be blocked. I currently use hand-written nftables rules to ensure this, but I am wondering if the default QubesOS firewall is sufficient. The default QubesOS IPv4 firewall rules follow: # Generated by iptables-save v1.4.5 on Mon Sep 6 08:57:46 2010 *nat :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :PR-QBS - [0:0] :PR-QBS-SERVICES - [0:0] -A PREROUTING -j PR-QBS -A PREROUTING -j PR-QBS-SERVICES -A POSTROUTING -o vif+ -j ACCEPT -A POSTROUTING -o lo -j ACCEPT -A POSTROUTING -j MASQUERADE COMMIT # Completed on Mon Sep 6 08:57:46 2010 # Generated by iptables-save v1.4.5 on Mon Sep 6 08:57:46 2010 *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :QBS-FORWARD - [0:0] -A INPUT -m state --state INVALID -j DROP -A INPUT -i vif+ -p udp -m udp --dport 68 -j DROP -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i vif+ -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -i vif+ -j REJECT --reject-with icmp-host-prohibited -A INPUT -j DROP -A FORWARD -m state --state INVALID -j DROP -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j QBS-FORWARD -A FORWARD -i vif+ -o vif+ -j DROP -A FORWARD -i vif+ -j ACCEPT -A FORWARD -j DROP COMMIT # Completed on Mon Sep 6 08:57:46 2010 And for IPv6: *nat :PREROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :PR-QBS - [0:0] :PR-QBS-SERVICES - [0:0] -A PREROUTING -j PR-QBS -A PREROUTING -j PR-QBS-SERVICES -A POSTROUTING -o vif+ -j ACCEPT -A POSTROUTING -o lo -j ACCEPT -A POSTROUTING -j MASQUERADE COMMIT *filter :INPUT DROP [0:0] :FORWARD DROP [0:0] :OUTPUT ACCEPT [0:0] :QBS-FORWARD - [0:0] -A INPUT -m state --state INVALID -j DROP -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A INPUT -i vif+ -p icmpv6 --icmpv6-type router-advertisement -j DROP -A INPUT -i vif+ -p icmpv6 --icmpv6-type redirect -j DROP -A INPUT -i vif+ -p icmpv6 -j ACCEPT -A INPUT -i vif+ -j REJECT --reject-with icmp6-adm-prohibited -A INPUT -p icmpv6 -j ACCEPT -A INPUT -j DROP -A FORWARD -m state --state INVALID -j DROP -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -j QBS-FORWARD -A FORWARD -i vif+ -o vif+ -j DROP -A FORWARD -i vif+ -j ACCEPT -A FORWARD -j DROP COMMIT Sincerely, Demi
signature.asc
Description: OpenPGP digital signature
