kunsi/bundlewrap
1
0
Fork 0
Code Issues 1 Pull requests 2 Releases Activity

modify nodes and bundles for new nftables syntax

Browse source
This commit is contained in:
Franzi 2021-06-03 13:59:15 +02:00
parent ecb67d012b
commit d569b00960
Signed by: kunsi
GPG key ID: 12E3D2136B818350
30 changed files with 172 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

20
bundles/wireguard/metadata.py
View file

@ -18,12 +18,14 @@ defaults = {
},
},
},
'iptables': {
'bundle_rules': {
'wireguard': [
'iptables_both -A FORWARD -i wg0 -j ACCEPT',
'iptables_both -A FORWARD -o wg0 -j ACCEPT',
],
'nftables': {
'rules': {
'forward': {
'wireguard': [
'iif wg0 accept',
'oif wg0 accept',
],
},
},
},
'wireguard': {
@ -149,9 +151,9 @@ def icinga2(metadata):
@metadata_reactor.provides(
'iptables/port_rules',
'firewall/port_rules',
)
def iptables(metadata):
def firewall(metadata):
sources = set(metadata.get('wireguard/restrict-to', set()))
for peer_name in metadata.get('wireguard/peers'):
try:
@ -162,7 +164,7 @@ def iptables(metadata):
sources.add(peer_name)
return {
'iptables': {
'firewall': {
'port_rules': {
'51820/udp': atomic(sources),
},