WireGuard Firewall Architecture

The concepts behind Wiretastix's dynamic nftables firewall: nftables vs iptables, tables, chains, and rule enforcement.

Wiretastix leverages nftables, the modern packet filtering framework in Linux, to enforce network access rules for WireGuard peers. This integration allows for granular control over what traffic is permitted or denied through the VPN.

nftables vs. iptables

nftables is the successor to the old iptables/ip6tables/arptables/ebtables tools and has been the Linux kernel’s packet filtering subsystem since kernel 3.13. On modern distributions, the iptables command itself is largely a compatibility layer (iptables-nft) that translates classic iptables syntax into nftables rules behind the scenes – the kernel is running nftables either way. Wiretastix talks to nftables directly over netlink (it doesn’t shell out to nft or iptables), which is also why it manages its own dedicated table rather than trying to interoperate with rules written in iptables syntax.

NFTables Table and Chain

Wiretastix operates within a dedicated nftables table and chain, which are configurable in the wiretastix.yaml file. By default, it uses the wiretastix table and wiretastix-forward chain. This isolation ensures that Wiretastix’s rules do not interfere with other firewall configurations on the system.

Rule Definition

Network rules in Wiretastix are defined as structured fields, not raw nftables expressions – group, nfproto (ip4/ip6), l4proto (tcp/udp/icmp), src, sport, dst, dport, and action (accept/drop/none). Wiretastix compiles these into nftables rules itself. Rules always target a group (not an individual user), and apply to every peer that belongs to it. See NFTables Integration for the full field reference and CLI examples.

Rule Application

When rules are created or modified via the Wiretastix CLI or API, they are stored in the database. However, these rules are not active until they are explicitly applied to the nftables firewall. The rule apply command (or its API equivalent) pushes the current set of rules from the database to the nftables system, making them active.

Dynamic Rule Enforcement

Wiretastix dynamically generates and updates nftables rules based on the configured peers, users, groups, and rules in its database. This means that as peers connect or disconnect, or as their associated users/groups change, the firewall rules can be automatically adjusted to reflect the desired network policy.

Initial Setup

During installation, you need to ensure that the nftables.conf file provided by Wiretastix is copied to a suitable location (e.g., /etc/wiretastix/nftables.conf) and that your system is configured to load these rules on startup. This typically involves setting up a systemd service or similar mechanism to ensure the nftables base configuration is in place before the Wiretastix daemon starts.

Integration with Other Firewall Tools

Wiretastix is built to be integrated into whatever environment you already run – it only manages its own dedicated nftables table (see above), so it doesn’t require exclusive control of the system firewall. That said, this documentation does not currently cover integrating it alongside frontend tools like ufw or firewalld (probably not yet). If you use one of these, keep in mind they manage their own base chains independently of Wiretastix’s table, and coexistence hasn’t been documented or tested here.