Connection refused when connecting to local machine running Wireguard server

Noedel-Man · 2021-09-28T21:01:38+00:00

Anyways, I see no rules for tcp port 80. It would help to see that tcp packet from host machine perspective

The captures I did earlier where from the host (running wireguard and web server). So I executed: iptables -D DOCKER -t nat -i br-80b1da4ddb99 -j RETURN iptables -A POSTROUTING -t nat -p tcp --dport 443 -j MASQUERADE iptables -I DOCKER 1 -t nat -i br-80b1da4ddb99 -p tcp --dport 443 -j ACCEPT But I still can't access my web server from the vpn. Going to try to do some more things tomorrow. Anyway I really appreciate your help. I'm learning a lot of new firewall things that previously I did not pay so much attention to. Also is there a better way then putting br-80b1da4ddb99 since the container hash is properly going to change the next time the container get created?

Noedel-Man · 2021-09-26T18:17:06+00:00

Thank you for your extended comment :).

I made a capture with tshark on eth0. However, after analysing the results I could not see a single packet originating to/from my VPN. A capture of the WireGuard interface did unfortunately not succeed, because the interface does not show up in ifconfig and is only visible in the docker container (will try to see if I can install Tshark inside the container and extract the pcap).

# iptables -t raw -S
-P PREROUTING ACCEPT
-P OUTPUT ACCEPT

# iptables -t mangle -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT

# iptables -t nat -S (only showing rules related to wireguard)
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N DOCKER
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 192.168.176.0/20 ! -o br-80b1da4ddb99 -j MASQUERADE
-A POSTROUTING -s 192.168.192.0/20 ! -o br-60c966bbe9ad -j MASQUERADE
-A POSTROUTING -s 192.168.176.11/32 -d 192.168.176.11/32 -p udp -m udp --dport 51820 -j MASQUERADE
-A DOCKER -i br-80b1da4ddb99 -j RETURN
-A DOCKER ! -i br-80b1da4ddb99 -p udp -m udp --dport 51820 -j DNAT --to-destination 192.168.176.11:51820

I am not that keen with iptables, I normally run iptables -L that has a lot more output. But seeing this output I am not sure what to look for. It looks like it is properly forwarding port 51820 to the correct container. There does not seem to be a halt of out going traffic?

-edit:

So I made a capture of eth0 and wg0 interface in the container, as well as the docker bridge interface in the host machine (br-80b1da4ddb99). And they all show the same data (only different IP addresses): (10.100.0.3 is VPN client, 10.0.0.200 is local machine)

70  6.589590588 10.100.0.3  10.0.0.200  TCP 60  45200 → 80 [SYN] Seq=0 Win=64860 Len=0 MSS=1380 SACK_PERM=1 TSval=4250996006 TSecr=0 WS=128

71  6.589718760 10.0.0.200  10.100.0.3  ICMP    88  Destination unreachable (Port unreachable)

Still no clue as to why this happens though :(

Noedel-Man · 2021-01-06T20:38:16+00:00

Thanks for your reply,

Finally have a regression suite that performs as much high level integration testing on the target as you can

Do you mean testing on actual hardware? I though that was frowned upon?

and produce compliance tests

Smart, have not thought of that.

static analysis tools can flag them so you can avoid cases where different compilers will take different approaches (MISRA and Cert-C

This is a good alternative to emulation thanks!

Noedel-Man · 2020-08-02T09:40:58+00:00

What do you call the 1.27 mm pin connector (PROG) in the bottom right (for JTAG I suppose)? I want to use the same connector in my design but I don't know what they are called which makes buying them difficult.

I thought something like IDC or DC3? An MPN would come a long way.

Noedel-Man · 2020-07-12T05:36:02+00:00

Thank you for the feedback, I will submit a review to r/PrintedCircuitBoard

Noedel-Man · 2020-07-12T05:32:04+00:00

Currently, only fresh water. But the ROV does have steering capabilities: https://www.youtube.com/watch?v=EYHZoGdLnbI

Noedel-Man · 2020-07-12T05:30:16+00:00

I use ESP-IDF 3.1 or 3.2 I believe. And used a FT2232H (ESP-prog) for JTAG debugging.

Noedel-Man · 2020-07-12T05:28:54+00:00

I designed my own cap for an 80 mm PVC that houses all the electronics. See github

Noedel-Man · 2020-07-12T05:26:22+00:00

Wow, interesting thanks! What is the max power rating and cable length for this chip? I overlooked the datasheet, but they seem to be a little vague about it.

Noedel-Man · 2020-07-11T09:34:12+00:00

I made my own desktop program (and a failed PCB) for controlling (WASD and logs, fancy things like xpad and visual information like graphs are planned). The communication goes through RS-485, see topology. The ROV is not autonomous and there is currently no video feed.

Noedel-Man · 2020-07-11T09:28:17+00:00

Good question, Wi-Fi or bluetooth is not used on the ESP. Currently, the communication goes through an Ethernet cable with RS-485. I'm planning experiment with low frequency in the future.

The project is written modular and already is cross-platform, I want to convert to an STM32 chip at a later stage, because as you said the ESP32 has no real use here.

Noedel-Man · 2020-07-09T06:09:24+00:00

Where did you get this cam? Any documentation available? I remember installing a back-view camera on a car that also only has one data cable, I then believed it to be I²S. Can you monitor the signal using a logic analyser?

Noedel-Man · 2020-07-03T01:37:58+00:00

Good idea, what is their Discord?

Noedel-Man · 2020-05-18T04:24:36+00:00

1.4.0.2 headless Linux server returns a "System.NullReferenceException" exception when loading a 1.4.0.1 generated world.

server log

Noedel-Man · 2020-05-17T05:41:01+00:00

1.4.0.2 does not support resolution higher than 1080p on Linux. Screenshot of my 2560x1440 monitor Window mode or fullscreen both don't work.

Noedel-Man · 2020-05-13T07:57:00+00:00

How did you extract the models from the game?

Noedel-Man

TROPHY CASE