This guide uses NetworkManager and firewalld. Both of these are installed and used by default on current versions of Red Hat Enterprise Linux and Fedora.
First, test that NetworkManager is in use:
# nmcli
eth0: connected to eth0
"The Linux Foundation Microsoft Hyper-V"
ethernet (hv_netvsc), 00:15:5D:01:03:0C, hw, mtu 1500
ip4 default, ip6 default
inet4 192.168.1.134/24
route4 192.168.1.0/24 metric 100
route4 default via 192.168.1.1 metric 100
inet6 2001:4c4e:24cd:d400:215:5dff:fe01:30c/64
inet6 fe80::215:5dff:fe01:30c/64
route6 fe80::/64 metric 1024
route6 2001:4c4e:24cd:d400::/64 metric 100
route6 2001:4c4e:24cd:d400::/64 via fe80::8efd:deff:fe33:fb18 metric 105
route6 default via fe80::8efd:deff:fe33:fb18 metric 100
lo: connected (externally) to lo
"lo"
loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536
inet4 127.0.0.1/8
inet6 ::1/128
DNS configuration:
servers: 192.168.1.1
domains: home
interface: eth0
servers: 2001:4c48:1::1
domains: home
interface: eth0
Then test that firewalld is active:
# firewall-cmd --state
running
VPN services that support WireGuard will usually have a configuration generator site or guide. My chosen service, AirVPN, generated the following file when selecting a Czeh server:
[Interface]
Address = 10.184.152.149/32, fd7d:76ee:e68f:a993:d172:bc31:cc8:3a7f/128
PrivateKey = 6K+Ij5DThhAdbW2YL7gyjvhKOTV37qmZZQ6p8oSjH0U=
MTU = 1320
DNS = 10.128.0.1, fd7d:76ee:e68f:a993::1
[Peer]
PublicKey = PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=
PresharedKey = bXLsMq+/4koXwJ8UFcqZCoGLJOzokeKiZd6M9VP0CDM=
Endpoint = 185.156.174.117:1637
AllowedIPs = 0.0.0.0/0, ::/0
PersistentKeepalive = 15These are usually fairly similar across services, so just substitute your own one in place.
Rename your configuration to the name you'd like the profile and interface to be named. I chose wg-centaurus.conf as that's what AirVPN calls this specific server. Then, import the file:
# nmcli connection import type wireguard file wg-centaurus.conf
Connection 'wg-centaurus' (4e1b0fd1-6fd1-46a1-9358-03b6f238d58f) successfully added.
It should automatically connect, and you should now have the masked IP address! We should test it:
# curl ipinfo.io
{
"ip": "185.156.174.115",
"hostname": "115.174.156.185.in-addr.arpa",
"city": "Prague",
"region": "Prague",
"country": "CZ",
"loc": "50.0880,14.4208",
"org": "AS9009 M247 Europe SRL",
"postal": "110 00",
"timezone": "Europe/Prague",
"readme": "https://ipinfo.io/missingauth"
}
# curl v6.ipinfo.io
{
"ip": "2001:ac8:33:8:f7e9:fa3:a40c:ab11",
"city": "Prague",
"region": "Prague",
"country": "CZ",
"loc": "50.0880,14.4208",
"org": "AS9009 M247 Europe SRL",
"postal": "110 00",
"timezone": "Europe/Prague",
"readme": "https://ipinfo.io/missingauth"
}
Now, see what happens if we disable the VPN profile:
# nmcli connection down wg-centaurus
Connection 'wg-centaurus' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3)
# curl ipinfo.io
{
...
"country": "HU",
...
}
#curl v6.ipinfo.io
{
...
"country": "HU",
...
}
As expected, the internet is still accessible, however the original IP is displayed.
To prevent this from happening, we'll be following meow646's blogpost on setting up a VPN Killswitch. Please visit their site for full details.
We first create the policy:
# firewall-cmd --permanent --new-zone VPN-Only
success
# firewall-cmd --permanent --zone VPN-Only --set-target DROP
success
# firewall-cmd --permanent --new-policy VPN-Killswitch
success
# firewall-cmd --permanent --policy VPN-Killswitch --set-target DROP
success
# firewall-cmd --reload
success
Then we exclude the VPN server from the policy. Since AirVPN is using a non-standard WireGuard port, we modify the command to allow a specific port instead of the predefined wireguard service:
# firewall-cmd --policy VPN-Killswitch --add-rich-rule='rule family="ipv4" destination address="185.156.174.117" port port="1637" protocol="udp" accept'
success
If you want to allow access to your LAN, you'll need to add a rule for that too. My network uses the 192.168.1.0/24 range, therefore I'm running the command unmodified:
# firewall-cmd --policy VPN-Killswitch --add-rich-rule='rule family="ipv4" destination address="192.168.1.0/24" accept'
success
Then we set ingress and egress zones:
# firewall-cmd --policy VPN-Killswitch --add-ingress-zone HOST
success
# firewall-cmd --policy VPN-Killswitch --add-egress-zone VPN-Only
success
Next we add the network interfaces. As seen in the initial nmcli, I only have one named eth0:
# firewall-cmd --permanent --zone VPN-Only --add-interface=eth0
The interface is under control of NetworkManager, setting zone to 'VPN-Only'.
success
And we should be done. Time to test it again:
# curl --connect-timeout 1 ipinfo.io
curl: (28) Failed to connect to ipinfo.io port 80 after 1001 ms: Timeout was reached
# curl --connect-timeout 1 v6.ipinfo.io
curl: (28) Failed to connect to v6.ipinfo.io port 80 after 1000 ms: Timeout was reached
Great, seems like there's no connection made. Let's enable VPN and try again:
# nmcli connection up wg-centaurus
Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/5)
# curl --connect-timeout 1 ipinfo.io
{
"ip": "185.156.174.115",
"hostname": "115.174.156.185.in-addr.arpa",
"city": "Prague",
"region": "Prague",
"country": "CZ",
"loc": "50.0880,14.4208",
"org": "AS9009 M247 Europe SRL",
"postal": "110 00",
"timezone": "Europe/Prague",
"readme": "https://ipinfo.io/missingauth"
}
# curl --connect-timeout 1 v6.ipinfo.io
{
"ip": "2001:ac8:33:8:f7e9:fa3:a40c:ab11",
"city": "Prague",
"region": "Prague",
"country": "CZ",
"loc": "50.0880,14.4208",
"org": "AS9009 M247 Europe SRL",
"postal": "110 00",
"timezone": "Europe/Prague",
"readme": "https://ipinfo.io/missingauth"
}
And it seems like the VPN connection still works as intended. Now, we should write the running configuration to file so it doesn't go away on a reboot:
# firewall-cmd --runtime-to-permanent
success
This is the exact same as without a VPN when using firewalld, however for the sake of completeness is included here. I prefer creating a "service" to group the VPN forwarded ports under:
# firewall-cmd --permanent --new-service=vpn-ports
success
# firewall-cmd --permanent --service=vpn-ports "--set-description=VPN Ports"
success
# firewall-cmd --permanent --service=vpn-ports "--set-short=VPN Ports"
success
# firewall-cmd --permanent --service=vpn-ports --add-port=3333/tcp
success
Now we just want to allow this service on the VPN connection's zone. Let's find out the zone:
# firewall-cmd --get-active-zones
FedoraServer
interfaces: wg-centaurus
VPN-Only
interfaces: eth0
And add the service:
# firewall-cmd --permanent --zone=FedoraServer --add-service=vpn-ports
success
Then reload, as --permanent does not apply to the current running configuration:
# firewall-cmd --reload
success
Let's test if it worked by listening on the port with netcat:
# nc -v -l 3333
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::3333
Ncat: Listening on 0.0.0.0:3333
And on another device, let's visit the expected URL:
# curl http://185.156.174.115:3333/
This should result in netcat printing the request:
Ncat: Connection from 185.9.19.107.
Ncat: Connection from 185.9.19.107:40518.
GET / HTTP/1.1
Host: 185.156.174.115:3333
User-Agent: curl/8.0.1
Accept: */*
Congratulations, your port forward is working!
"WireGuard" is a registered trademark of Jason A. Donenfeld.
LICENSE OF THIS GUIDE:
Creative Commons Legal Code
CC0 1.0 Universal
CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
HEREUNDER.
Statement of Purpose
The laws of most jurisdictions throughout the world automatically confer
exclusive Copyright and Related Rights (defined below) upon the creator
and subsequent owner(s) (each and all, an "owner") of an original work of
authorship and/or a database (each, a "Work").
Certain owners wish to permanently relinquish those rights to a Work for
the purpose of contributing to a commons of creative, cultural and
scientific works ("Commons") that the public can reliably and without fear
of later claims of infringement build upon, modify, incorporate in other
works, reuse and redistribute as freely as possible in any form whatsoever
and for any purposes, including without limitation commercial purposes.
These owners may contribute to the Commons to promote the ideal of a free
culture and the further production of creative, cultural and scientific
works, or to gain reputation or greater distribution for their Work in
part through the use and efforts of others.
For these and/or other purposes and motivations, and without any
expectation of additional consideration or compensation, the person
associating CC0 with a Work (the "Affirmer"), to the extent that he or she
is an owner of Copyright and Related Rights in the Work, voluntarily
elects to apply CC0 to the Work and publicly distribute the Work under its
terms, with knowledge of his or her Copyright and Related Rights in the
Work and the meaning and intended legal effect of CC0 on those rights.
1. Copyright and Related Rights. A Work made available under CC0 may be
protected by copyright and related or neighboring rights ("Copyright and
Related Rights"). Copyright and Related Rights include, but are not
limited to, the following:
i. the right to reproduce, adapt, distribute, perform, display,
communicate, and translate a Work;
ii. moral rights retained by the original author(s) and/or performer(s);
iii. publicity and privacy rights pertaining to a person's image or
likeness depicted in a Work;
iv. rights protecting against unfair competition in regards to a Work,
subject to the limitations in paragraph 4(a), below;
v. rights protecting the extraction, dissemination, use and reuse of data
in a Work;
vi. database rights (such as those arising under Directive 96/9/EC of the
European Parliament and of the Council of 11 March 1996 on the legal
protection of databases, and under any national implementation
thereof, including any amended or successor version of such
directive); and
vii. other similar, equivalent or corresponding rights throughout the
world based on applicable law or treaty, and any national
implementations thereof.
2. Waiver. To the greatest extent permitted by, but not in contravention
of, applicable law, Affirmer hereby overtly, fully, permanently,
irrevocably and unconditionally waives, abandons, and surrenders all of
Affirmer's Copyright and Related Rights and associated claims and causes
of action, whether now known or unknown (including existing as well as
future claims and causes of action), in the Work (i) in all territories
worldwide, (ii) for the maximum duration provided by applicable law or
treaty (including future time extensions), (iii) in any current or future
medium and for any number of copies, and (iv) for any purpose whatsoever,
including without limitation commercial, advertising or promotional
purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
member of the public at large and to the detriment of Affirmer's heirs and
successors, fully intending that such Waiver shall not be subject to
revocation, rescission, cancellation, termination, or any other legal or
equitable action to disrupt the quiet enjoyment of the Work by the public
as contemplated by Affirmer's express Statement of Purpose.
3. Public License Fallback. Should any part of the Waiver for any reason
be judged legally invalid or ineffective under applicable law, then the
Waiver shall be preserved to the maximum extent permitted taking into
account Affirmer's express Statement of Purpose. In addition, to the
extent the Waiver is so judged Affirmer hereby grants to each affected
person a royalty-free, non transferable, non sublicensable, non exclusive,
irrevocable and unconditional license to exercise Affirmer's Copyright and
Related Rights in the Work (i) in all territories worldwide, (ii) for the
maximum duration provided by applicable law or treaty (including future
time extensions), (iii) in any current or future medium and for any number
of copies, and (iv) for any purpose whatsoever, including without
limitation commercial, advertising or promotional purposes (the
"License"). The License shall be deemed effective as of the date CC0 was
applied by Affirmer to the Work. Should any part of the License for any
reason be judged legally invalid or ineffective under applicable law, such
partial invalidity or ineffectiveness shall not invalidate the remainder
of the License, and in such case Affirmer hereby affirms that he or she
will not (i) exercise any of his or her remaining Copyright and Related
Rights in the Work or (ii) assert any associated claims and causes of
action with respect to the Work, in either case contrary to Affirmer's
express Statement of Purpose.
4. Limitations and Disclaimers.
a. No trademark or patent rights held by Affirmer are waived, abandoned,
surrendered, licensed or otherwise affected by this document.
b. Affirmer offers the Work as-is and makes no representations or
warranties of any kind concerning the Work, express, implied,
statutory or otherwise, including without limitation warranties of
title, merchantability, fitness for a particular purpose, non
infringement, or the absence of latent or other defects, accuracy, or
the present or absence of errors, whether or not discoverable, all to
the greatest extent permissible under applicable law.
c. Affirmer disclaims responsibility for clearing rights of other persons
that may apply to the Work or any use thereof, including without
limitation any person's Copyright and Related Rights in the Work.
Further, Affirmer disclaims responsibility for obtaining any necessary
consents, permissions or other rights required for any use of the
Work.
d. Affirmer understands and acknowledges that Creative Commons is not a
party to this document and has no duty or obligation with respect to
this CC0 or use of the Work.