Wireguard iptables rules for Oracle VPS

Oracle VPS instance has a set of quite strict initial iptables rules for the safety of server, therefore we need to open the access from these new interfaces and ports, and also, insert these rules to the top of chains.

You can follow the rules in /etc/wireguard/wg%i.conf below, where enp0s6 needs to be modified to your own internet interface.

PostUp = iptables -I FORWARD 1 -o %i -j ACCEPT; iptables -I FORWARD 1 -i %i -j ACCEPT; iptables -I INPUT 1 -i enp0s6 -p udp --dport 51820 -j ACCEPT; iptables -I INPUT 1 -i %i -j ACCEPT; iptables -t nat -I POSTROUTING 1 -o enp0s6 -j MASQUERADE
PostDown = iptables -D FORWARD -o %i -j ACCEPT; iptables -D FORWARD -i %i -j ACCEPT; iptables -D INPUT -i enp0s6 -p udp --dport 51820 -i wg0 -j ACCEPT; iptables -D INPUT -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o enp0s6 -j MASQUERADE

We maybe also need to enforce at least FORWARD chain is set default policy to DROP by having

*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

in /etc/iptables/rules.v4 and install iptables-persistent by sudo apt-get install iptables-persistent.