WireGuard support?

[ngoquang2708]

I have a linux server with both WireGuard (act as a VPN server) and dpibreak installed.
When I connect other clients to this server using WireGuard, it seems that traffics from WireGuard clients don't get handled by dpibreak. Mean that I can access normal websites but not blocked websites.
Beside, I can curl to blocked websites directly on the server itself.
Is there a way to make this setup work?
Thanks.

[dilluti0n]

Thanks for the report.

The hardcoded nftables rules from dpibreak currently do not catch packets forwarded from the wireguard interface.

Try running dpibreak with this:

#!/bin/bash
table=dpibreak
dpibreak "$@" &
pid=$!
for _ in $(seq 1 50); do
    if nft list chain inet $table OUTPUT &>/dev/null; then
        # copy queue number and clienthello filter from dpibreak
        rule=$(nft -a list chain inet $table OUTPUT \
               | grep -m1 'queue' | sed 's/ # handle.*//')
        nft add chain inet $table FORWARD \
          '{ type filter hook forward priority 0; policy accept; }'
        nft add rule inet $table FORWARD $rule
        break
    fi
    sleep 0.1
done
wait $pid

Please let me know if this works for you - if it does I'll maybe add it into a hardcoded rules.

Related: #28

[ngoquang2708]

Your script works perfectly. Thank you.