amnezia-vpn/amnezia-client

Fork 0

mirror of https://github.com/amnezia-vpn/amnezia-client.git synced 2026-10-15 13:52:15 +00:00

[GH-ISSUE #1173] No connection (strange iptables rule) #428

New issue

Closed

opened 2026-10-13 20:21:17 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-13 20:21:17 +00:00

Owner

Originally created by @AKotov-dev on GitHub (Oct 16, 2024).
Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1173

Describe the bug
No connection with WARP.conf configuration.

OS: Mageia-9 Linux

To Reproduce
Steps to reproduce the behavior:

I created Cloudflare WARP for AmneziaWG (WARP.conf) configuration
Downloaded and installed AmneziaVPN_Linux_installer_4.8.1.9.tar.zip
Launched the client and loaded the configuration into it (1), pressed the "Connect" button
...there is no connection

I'm looking at the rules (iptables -S)

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N amnvpn.000.allowLoopback
-N amnvpn.100.blockAll
-N amnvpn.110.allowNets
-N amnvpn.120.blockNets
-N amnvpn.200.allowVPN
-N amnvpn.290.allowDHCP
-N amnvpn.300.allowLAN
-N amnvpn.310.blockDNS
-N amnvpn.320.allowDNS
-N amnvpn.a.000.allowLoopback
-N amnvpn.a.100.blockAll
-N amnvpn.a.110.allowNets
-N amnvpn.a.120.blockNets
-N amnvpn.a.200.allowVPN
-N amnvpn.a.290.allowDHCP
-N amnvpn.a.300.allowLAN
-N amnvpn.a.310.blockDNS
-N amnvpn.a.320.allowDNS
-N amnvpn.anchors
-A OUTPUT -j amnvpn.anchors
-A amnvpn.000.allowLoopback -o lo+ -j ACCEPT
-A amnvpn.100.blockAll -j REJECT --reject-with icmp-port-unreachable
-A amnvpn.120.blockNets -d 0.0.0.0/1 -j REJECT --reject-with icmp-port-unreachable
-A amnvpn.120.blockNets -d 128.0.0.0/1 -j REJECT --reject-with icmp-port-unreachable
-A amnvpn.200.allowVPN -o amn0+ -j ACCEPT
-A amnvpn.200.allowVPN -o tun0+ -j ACCEPT
-A amnvpn.290.allowDHCP -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A amnvpn.300.allowLAN -d 10.0.0.0/8 -j ACCEPT
-A amnvpn.300.allowLAN -d 169.254.0.0/16 -j ACCEPT
-A amnvpn.300.allowLAN -d 172.16.0.0/12 -j ACCEPT
-A amnvpn.300.allowLAN -d 192.168.0.0/16 -j ACCEPT
-A amnvpn.300.allowLAN -d 224.0.0.0/4 -j ACCEPT
-A amnvpn.300.allowLAN -d 255.255.255.255/32 -j ACCEPT
-A amnvpn.310.blockDNS -p udp -m udp --dport 53 -j REJECT --reject-with icmp-port-unreachable
-A amnvpn.310.blockDNS -p tcp -m tcp --dport 53 -j REJECT --reject-with icmp-port-unreachable
-A amnvpn.320.allowDNS -d 1.1.1.1/32 -o amn0+ -p udp -m udp --dport 53 -j ACCEPT
-A amnvpn.320.allowDNS -d 1.1.1.1/32 -o amn0+ -p tcp -m tcp --dport 53 -j ACCEPT
-A amnvpn.320.allowDNS -d 1.1.1.1/32 -o tun0+ -p udp -m udp --dport 53 -j ACCEPT
-A amnvpn.320.allowDNS -d 1.1.1.1/32 -o tun0+ -p tcp -m tcp --dport 53 -j ACCEPT
-A amnvpn.a.000.allowLoopback -j amnvpn.000.allowLoopback
-A amnvpn.a.120.blockNets -j amnvpn.120.blockNets
-A amnvpn.a.200.allowVPN -j amnvpn.200.allowVPN
-A amnvpn.a.290.allowDHCP -j amnvpn.290.allowDHCP
-A amnvpn.a.300.allowLAN -j amnvpn.300.allowLAN
-A amnvpn.a.310.blockDNS -j amnvpn.310.blockDNS
-A amnvpn.a.320.allowDNS -j amnvpn.320.allowDNS
-A amnvpn.anchors -j amnvpn.a.000.allowLoopback
-A amnvpn.anchors -j amnvpn.a.320.allowDNS
-A amnvpn.anchors -j amnvpn.a.310.blockDNS
-A amnvpn.anchors -j amnvpn.a.300.allowLAN
-A amnvpn.anchors -j amnvpn.a.290.allowDHCP
-A amnvpn.anchors -j amnvpn.a.200.allowVPN
-A amnvpn.anchors -j amnvpn.a.120.blockNets
-A amnvpn.anchors -j amnvpn.a.110.allowNets
-A amnvpn.anchors -j amnvpn.a.100.blockAll

I delete the rule:

iptables -D amnvpn.120.blockNets -d 128.0.0.0/1 -j REJECT --reject-with icmp-port-unreachable

The connection is now established...

Question: What to do? :(

Originally created by @AKotov-dev on GitHub (Oct 16, 2024). Original GitHub issue: https://github.com/amnezia-vpn/amnezia-client/issues/1173 **Describe the bug** No connection with `WARP.conf` configuration. **OS:** Mageia-9 Linux **To Reproduce** Steps to reproduce the behavior: 1. I created [Cloudflare WARP for AmneziaWG (WARP.conf)](https://github.com/ImMALWARE/bash-warp-generator) configuration 2. Downloaded and installed [AmneziaVPN_Linux_installer_4.8.1.9.tar.zip](https://github.com/amnezia-vpn/amnezia-client/releases) 3. Launched the client and loaded the configuration into it (1), pressed the "Connect" button 4. ...there is no connection ![no_connection](https://github.com/user-attachments/assets/cfbbaf50-8ffb-41b8-b6c1-20115cf9f702) <details><summary>I'm looking at the rules (iptables -S)</summary> <pre> -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -N amnvpn.000.allowLoopback -N amnvpn.100.blockAll -N amnvpn.110.allowNets -N amnvpn.120.blockNets -N amnvpn.200.allowVPN -N amnvpn.290.allowDHCP -N amnvpn.300.allowLAN -N amnvpn.310.blockDNS -N amnvpn.320.allowDNS -N amnvpn.a.000.allowLoopback -N amnvpn.a.100.blockAll -N amnvpn.a.110.allowNets -N amnvpn.a.120.blockNets -N amnvpn.a.200.allowVPN -N amnvpn.a.290.allowDHCP -N amnvpn.a.300.allowLAN -N amnvpn.a.310.blockDNS -N amnvpn.a.320.allowDNS -N amnvpn.anchors -A OUTPUT -j amnvpn.anchors -A amnvpn.000.allowLoopback -o lo+ -j ACCEPT -A amnvpn.100.blockAll -j REJECT --reject-with icmp-port-unreachable -A amnvpn.120.blockNets -d 0.0.0.0/1 -j REJECT --reject-with icmp-port-unreachable -A amnvpn.120.blockNets -d 128.0.0.0/1 -j REJECT --reject-with icmp-port-unreachable -A amnvpn.200.allowVPN -o amn0+ -j ACCEPT -A amnvpn.200.allowVPN -o tun0+ -j ACCEPT -A amnvpn.290.allowDHCP -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -j ACCEPT -A amnvpn.300.allowLAN -d 10.0.0.0/8 -j ACCEPT -A amnvpn.300.allowLAN -d 169.254.0.0/16 -j ACCEPT -A amnvpn.300.allowLAN -d 172.16.0.0/12 -j ACCEPT -A amnvpn.300.allowLAN -d 192.168.0.0/16 -j ACCEPT -A amnvpn.300.allowLAN -d 224.0.0.0/4 -j ACCEPT -A amnvpn.300.allowLAN -d 255.255.255.255/32 -j ACCEPT -A amnvpn.310.blockDNS -p udp -m udp --dport 53 -j REJECT --reject-with icmp-port-unreachable -A amnvpn.310.blockDNS -p tcp -m tcp --dport 53 -j REJECT --reject-with icmp-port-unreachable -A amnvpn.320.allowDNS -d 1.1.1.1/32 -o amn0+ -p udp -m udp --dport 53 -j ACCEPT -A amnvpn.320.allowDNS -d 1.1.1.1/32 -o amn0+ -p tcp -m tcp --dport 53 -j ACCEPT -A amnvpn.320.allowDNS -d 1.1.1.1/32 -o tun0+ -p udp -m udp --dport 53 -j ACCEPT -A amnvpn.320.allowDNS -d 1.1.1.1/32 -o tun0+ -p tcp -m tcp --dport 53 -j ACCEPT -A amnvpn.a.000.allowLoopback -j amnvpn.000.allowLoopback -A amnvpn.a.120.blockNets -j amnvpn.120.blockNets -A amnvpn.a.200.allowVPN -j amnvpn.200.allowVPN -A amnvpn.a.290.allowDHCP -j amnvpn.290.allowDHCP -A amnvpn.a.300.allowLAN -j amnvpn.300.allowLAN -A amnvpn.a.310.blockDNS -j amnvpn.310.blockDNS -A amnvpn.a.320.allowDNS -j amnvpn.320.allowDNS -A amnvpn.anchors -j amnvpn.a.000.allowLoopback -A amnvpn.anchors -j amnvpn.a.320.allowDNS -A amnvpn.anchors -j amnvpn.a.310.blockDNS -A amnvpn.anchors -j amnvpn.a.300.allowLAN -A amnvpn.anchors -j amnvpn.a.290.allowDHCP -A amnvpn.anchors -j amnvpn.a.200.allowVPN -A amnvpn.anchors -j amnvpn.a.120.blockNets -A amnvpn.anchors -j amnvpn.a.110.allowNets -A amnvpn.anchors -j amnvpn.a.100.blockAll </pre> </details> I delete the rule: ``` iptables -D amnvpn.120.blockNets -d 128.0.0.0/1 -j REJECT --reject-with icmp-port-unreachable ``` The connection is now established... ![yes_connect](https://github.com/user-attachments/assets/30bad0bc-666d-4e1f-8c17-6a6145f7607e) **Question:** What to do? :(

bsakaguchi closed this issue

2026-10-13 20:21:17 +00:00

bsakaguchi commented

2026-10-13 20:21:18 +00:00

Author

Owner

@AKotov-dev commented on GitHub (Oct 17, 2024):

Посмотрел для интереса код /amnezia-client/client/platform/linux/daemon/wireguardutilslinux.cpp

...
if (config.m_killSwitchEnabled) {
            FirewallParams params { };
            params.dnsServers.append(config.m_dnsServer);
            if (config.m_allowedIPAddressRanges.contains(IPAddress("0.0.0.0/0"))) {
                params.blockAll = true;
                if (config.m_excludedAddresses.size()) {
                    params.allowNets = true;
                    foreach (auto net, config.m_excludedAddresses) {
                        params.allowAddrs.append(net.toUtf8());
                    }
                }
            } else {
                params.blockNets = true;
                foreach (auto net, config.m_allowedIPAddressRanges) {
                    params.blockAddrs.append(net.toString());
...

Получается, что blockNets так же привязан к Settings-Connection-KillSwitch. Если KillSwitch отключить, то коннект происходит. Тогда не понятно куда приткнуть KillSwitch, ведь его функция состоит в аварийном отключении, а не в случае стабильного подключения к серверу. Так же интересно, что скажет на это https://www.dnsleaktest.com Хммм...

@AKotov-dev commented on GitHub (Oct 17, 2024): Посмотрел для интереса код /amnezia-client/client/platform/linux/daemon/wireguardutilslinux.cpp ``` ... if (config.m_killSwitchEnabled) { FirewallParams params { }; params.dnsServers.append(config.m_dnsServer); if (config.m_allowedIPAddressRanges.contains(IPAddress("0.0.0.0/0"))) { params.blockAll = true; if (config.m_excludedAddresses.size()) { params.allowNets = true; foreach (auto net, config.m_excludedAddresses) { params.allowAddrs.append(net.toUtf8()); } } } else { params.blockNets = true; foreach (auto net, config.m_allowedIPAddressRanges) { params.blockAddrs.append(net.toString()); ... ``` Получается, что `blockNets` так же привязан к `Settings-Connection-KillSwitch`. **Если `KillSwitch` отключить, то коннект происходит.** Тогда не понятно куда приткнуть `KillSwitch`, ведь его функция состоит в аварийном отключении, а не в случае стабильного подключения к серверу. Так же интересно, что скажет на это https://www.dnsleaktest.com Хммм...

bsakaguchi commented

2026-10-13 20:21:18 +00:00

Author

Owner

@AKotov-dev commented on GitHub (Nov 19, 2024):

AmneziaVPN_4.8.2.3_Linux_installer.tar.zip - вроде бы ушла проблема... Спасибо. :)

@AKotov-dev commented on GitHub (Nov 19, 2024): [AmneziaVPN_4.8.2.3_Linux_installer.tar.zip](https://github.com/amnezia-vpn/amnezia-client/releases/download/4.8.2.3/AmneziaVPN_4.8.2.3_Linux_installer.tar.zip) - вроде бы ушла проблема... Спасибо. :)

bsakaguchi referenced this issue

2026-10-13 21:17:05 +00:00

[PR #602] [MERGED] Replace sftp with scp #1954

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

amnezia-vpn/amnezia-client#428

No description provided.

Rows
Columns