Using WireGuard with Web access protection

Issue

Suppose Web Access Protection (WAP) is combined with WireGuard using wg-quick from the command line or as a service. In that case, internet connectivity may be lost when both WAP and WireGuard interfaces are enabled. This is caused by a rule added to nftables by wg-quick, when an interface is brought up. Assume the interface is wg0, with an IP address 10.10.10.2. The rule is added to table wg-quick-wg0, chain preraw and looks like this:

The purpose of this rule is to provide some protection against configuration issues and malicious packets.

Workaround

On a properly configured and secured system, the nftables rule should not be necessary. Configuring wg-quick not to leave that rule in place should fix the connection issues. For example, you can edit the configuration file for the affected interface and, in the [Interface] section, add the following PostUp action:

Note that the wg-quick-wg0 name applies only to the “wg0” interface and has to be changed accordingly for other interfaces. If you still want to get some level of protection in place, you can replace the rule with a weaker one, for example, like this:

Remember that all mentions of “wg0” must be updated if the interface is not “wg0”. Also, it is necessary to update the IP address if it is not 10.10.10.2.