Article 5120N rule in RAW table - PREROUTING

rule in RAW table - PREROUTING

by
vincix
from LinuxQuestions.org on (#5120N)
I'm trying to understand all in all how wireguard adds its routing and how it makes use of RPDB and all that.
So I'd like to understanding the idea behind creating a DROP rule in the raw table in the PREROUTING chain. This is on the client-side.
Code:iptables -t raw -vnL
Chain PREROUTING (policy ACCEPT 61 packets, 9456 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- !wg0-client * 0.0.0.0/0 10.200.200.2 ADDRTYPE match src-type !LOCAL /* wg-quick(8) rule for wg0-client */

Chain OUTPUT (policy ACCEPT 406 packets, 40143 bytes)
pkts bytes target prot opt in out source destinationSo as I understand it, all packages that don't stem from the wireguard interface (wg0-client) and whose destination is 10.200.200.2 (the ip assigned on the VPN interface) and whose source IP is not locally assigned on any interface are DROPED.

Of course, the context is bigger, as I said, it's related to RPDB and also rules added in the mangle table. I'm not sure if this rule can be discussed somehow independently of the other rules.
An addition question would be, why doesn't OpenVPN do something similar, for instance? What's the advantage of such an approach?

For reference, this is how the mangle table looks like:
Code:iptables -t mangle -vnL
Chain PREROUTING (policy ACCEPT 627 packets, 55910 bytes)
pkts bytes target prot opt in out source destination
77 5556 CONNMARK udp -- * * 0.0.0.0/0 0.0.0.0/0 /* wg-quick(8) rule for wg0-client */ CONNMARK restore

Chain INPUT (policy ACCEPT 627 packets, 55910 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 1757 packets, 148K bytes)
pkts bytes target prot opt in out source destination

Chain POSTROUTING (policy ACCEPT 1757 packets, 148K bytes)
pkts bytes target prot opt in out source destination
886 104K CONNMARK udp -- * * 0.0.0.0/0 0.0.0.0/0 mark match 0xca6c /* wg-quick(8) rule for wg0-client */ CONNMARK saveAnd the ip rules:
Code:ip rule
0: from all lookup local
32764: from all lookup main suppress_prefixlength 0
32765: not from all fwmark 0xca6c lookup 51820
32766: from all lookup main
32767: from all lookup defaultlatest?d=yIl2AUoC8zA latest?i=Miku27WGM0I:fQpL7LvHVGk:F7zBnMy latest?i=Miku27WGM0I:fQpL7LvHVGk:V_sGLiP latest?d=qj6IDK7rITs latest?i=Miku27WGM0I:fQpL7LvHVGk:gIN9vFwMiku27WGM0I
External Content
Source RSS or Atom Feed
Feed Location https://feeds.feedburner.com/linuxquestions/latest
Feed Title LinuxQuestions.org
Feed Link https://www.linuxquestions.org/questions/
Reply 0 comments