Firewall rules

[tghdev]

Hello folks,

my wireguard configuration is just successfull, i.e. handshake, when my DS218+ firewall is off. I can't get it work with firewall rules. I've tried to allow traffic for all interfaces and ports for my wireguard subnet 192.168.200.0/255.255.255.0.

Server

[Interface]
Address = 192.168.200.1/24
ListenPort = 51820
PrivateKey = ...
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; sleep 5 ; ip route add 192.168.200.0/24 dev %i
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = ...
PresharedKey = ...
AllowedIPs = 192.168.200.2/32

Client

[Interface]
Address = 192.168.200.2/24
ListenPort = 51820
PrivateKey = ...

[Peer]
PublicKey = ...
PresharedKey = ...
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = address.tld:51820

Would appreciate feedback from the community.

Edit: Added client config

[tghdev]

So, I managed to get it work. Seems like the race issue #10 was the problem and iptables were not updated on PostUp. But still, the problem arises on random occasions on boot. Can maybe anyone provide a shell script which checks the iptables for the PostUp definition and loops as long as the iptables are not updated.