[{"content":"Forwarding ports over WireGuard manually requires a long chain of firewall commands. tun-nat replaces them with a single configuration file on top of nftables.\nStep 1. Installation Requirement: the tool works only with nftables. Check: nft --version; if the command is not found - sudo apt install nftables.\nsudo git clone https://github.com/lashkinse/tun-nat.git /etc/tun-nat No git? Run this first: sudo apt install git.\nStep 2. Configuration Open /etc/tun-nat/config.toml and adjust it to your needs:\n[tunnel] interface = \u0026#34;wg0\u0026#34; # tunnel interface (WireGuard) port = 51820 # WireGuard port [external] interface = \u0026#34;eth0\u0026#34; # server\u0026#39;s external interface ip = \u0026#34;\u0026#34; # empty = automatic mode (MASQUERADE) # Game server: 27015 tcp + udp to 10.0.0.2 [[port_rules]] protocol = \u0026#34;tcp\u0026#34; target = \u0026#34;10.0.0.2\u0026#34; ports = \u0026#34;27015\u0026#34; [[port_rules]] protocol = \u0026#34;udp\u0026#34; target = \u0026#34;10.0.0.2\u0026#34; ports = \u0026#34;27015\u0026#34; # Web service: 8080 to 10.0.0.3 [[port_rules]] protocol = \u0026#34;tcp\u0026#34; target = \u0026#34;10.0.0.3\u0026#34; ports = \u0026#34;8080\u0026#34; A new rule is a copy of a [[port_rules]] block with your own values:\nprotocol - tcp or udp; target - IP address of the device inside the tunnel; ports - a single port (27015) or a range (27015-27050). Step 3. Automatic setup with the tunnel Add two lines to the [Interface] section of /etc/wireguard/wg0.conf:\n[Interface] # ...your existing settings... PostUp = /etc/tun-nat/apply-nat.sh # apply rules on start PreDown = /etc/tun-nat/apply-nat.sh --down # remove them on shutdown Use PreDown, not PostDown: by the time PostDown runs, the interface is already gone, and the script won\u0026rsquo;t be able to find it to clean up the rules.\nRestart the tunnel:\nsudo wg-quick down wg0 \u0026amp;\u0026amp; sudo wg-quick up wg0 Done: traffic to the specified ports on your server is now forwarded to the devices inside the tunnel.\n🔗 Source code and documentation: github.com/lashkinse/tun-nat\n","permalink":"https://lashkin.ru/en/posts/tun-nat/","summary":"\u003cp\u003eForwarding ports over WireGuard manually requires a long chain of firewall commands. \u003cstrong\u003e\u003ca href=\"https://github.com/lashkinse/tun-nat\"\u003etun-nat\u003c/a\u003e\u003c/strong\u003e replaces them with a single configuration file on top of nftables.\u003c/p\u003e\n\u003ch3 id=\"step-1-installation\"\u003eStep 1. Installation\u003c/h3\u003e\n\u003cblockquote\u003e\n\u003cp\u003e\u003cstrong\u003eRequirement:\u003c/strong\u003e the tool works only with \u003ccode\u003enftables\u003c/code\u003e. Check: \u003ccode\u003enft --version\u003c/code\u003e; if the command is not found - \u003ccode\u003esudo apt install nftables\u003c/code\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;\"\u003e\u003ccode class=\"language-bash\" data-lang=\"bash\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003esudo git clone https://github.com/lashkinse/tun-nat.git /etc/tun-nat\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eNo \u003ccode\u003egit\u003c/code\u003e? Run this first: \u003ccode\u003esudo apt install git\u003c/code\u003e.\u003c/p\u003e\n\u003ch3 id=\"step-2-configuration\"\u003eStep 2. Configuration\u003c/h3\u003e\n\u003cp\u003eOpen \u003ccode\u003e/etc/tun-nat/config.toml\u003c/code\u003e and adjust it to your needs:\u003c/p\u003e","title":"Port Forwarding over WireGuard in 3 Steps with tun-nat"},{"content":"Hi! I\u0026rsquo;m Sergey Lashkin - Backend, DevOps, and Reverse Engineer.\nI create comprehensive solutions for gaming projects: from deploying server infrastructure to developing web platforms, online stores, and integrations with external services.\nContacts ✈️ Telegram: @lashkinse (primary) 💻 GitHub: github.com/lashkinse 📧 Email: lashkinse+job + @ + ya.ru Stack Languages: C++, C#, Python, Bash Backend \u0026amp; Web: REST API, Databases, Web platforms Infrastructure: Linux, Windows, Docker, CI/CD Focus: Game servers, Web platforms, API \u0026amp; Integrations, Reverse engineering ","permalink":"https://lashkin.ru/en/about/","summary":"\u003cp\u003eHi! I\u0026rsquo;m \u003cstrong\u003eSergey Lashkin\u003c/strong\u003e - Backend, DevOps, and Reverse Engineer.\u003c/p\u003e\n\u003cp\u003eI create comprehensive solutions for gaming projects: from deploying server infrastructure to developing web platforms, online stores, and integrations with external services.\u003c/p\u003e\n\u003ch3 id=\"contacts\"\u003eContacts\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e✈️ \u003cstrong\u003eTelegram:\u003c/strong\u003e \u003ca href=\"https://t.me/lashkinse\"\u003e@lashkinse\u003c/a\u003e \u003cem\u003e(primary)\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e💻 \u003cstrong\u003eGitHub:\u003c/strong\u003e \u003ca href=\"https://github.com/lashkinse\"\u003egithub.com/lashkinse\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e📧 \u003cstrong\u003eEmail:\u003c/strong\u003e \u003ccode\u003elashkinse+job\u003c/code\u003e + \u003ccode\u003e@\u003c/code\u003e + \u003ccode\u003eya.ru\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"stack\"\u003eStack\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eLanguages:\u003c/strong\u003e C++, C#, Python, Bash\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eBackend \u0026amp; Web:\u003c/strong\u003e REST API, Databases, Web platforms\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInfrastructure:\u003c/strong\u003e Linux, Windows, Docker, CI/CD\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFocus:\u003c/strong\u003e Game servers, Web platforms, API \u0026amp; Integrations, Reverse engineering\u003c/li\u003e\n\u003c/ul\u003e","title":"About Me"}]