Routing / IPFW help?
reddit / freebsd

----------------------------------------------------------------------
moxz42 · 2021-05-05 04:36

Hi I have a special case where I need to reach certain devices
(located elsewhere in giant wood trucks) via Wireguard. I have asked
this in Wireguard subreddit and gotten help to get it to work on Linux
but we want to use FreeBSD as the Wireguard server.

So first let me describe why there is a issue.In the wood trucks there
is a 4G modem that I can control and have Wireguard in them however
the device we need to reach is behind that and has the same subnet in
all Wood trucks and can't be changed. So what I need to do is policy
based routing on the Wireguard server this is achieved by the config
posted bellow in Linux, With the help from the Wireguard subreddit.

    [Interface]
    Address = 172.16.20.1/30
    Table = 2001
    PostUp = ip rule add from 172.16.0.6 table 2001
    PostDown = ip rule add from 172.16.0.6 table 2001
    ListenPort = 52001
    PrivateKey = PRIVKEY
    [Peer]  PublicKey = PUBKEY
    AllowedIPs = 172.16.20.2/32, 10.0.1.0/24

I have activated FIB and the Allowed ip's is pushed to that table/fib.
The PostUP/PostDown does no work since ip command is not supported in
FreeBSD so I need to approach the policy based routing some other
way.I have googled a-lot and tried around with IPFW but i cant get
172.16.0.6 to speak to 10.0.1.0/24 .Do anyone have any idea of how to
implement it?
It is no problem to reach 172.16.20.2 from 172.16.0.6

----------------------------------------------------------------------
TransientVoltage409 · 2021-05-05 05:43

Check that ipfw is not dropping traffic to/from 10.0.0.0/8, IIRC most
of the the default rulesets drop those as per RFC1918. After your
rules load, do `ipfw show` to see the entire running configuration.