41 lines
1.5 KiB
Django/Jinja
41 lines
1.5 KiB
Django/Jinja
{{ ansible_managed | comment }}
|
|
|
|
table inet wgrelay
|
|
delete table inet wgrelay
|
|
|
|
table inet wgrelay {
|
|
chain input {
|
|
type filter hook input priority 0; policy accept;
|
|
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
|
|
# --- traffic arriving over the tunnel -------------------------------
|
|
# Ping across the tunnel is useful for debugging and harmless.
|
|
iifname "{{ wg_interface }}" icmp type echo-request accept
|
|
iifname "{{ wg_interface }}" icmpv6 type echo-request accept
|
|
|
|
{% for r in relays if r.direction == 'inbound' %}
|
|
# {{ r.name }}: only {{ r.source_allow }} may reach this listener
|
|
iifname "{{ wg_interface }}" ip saddr {{ r.source_allow }} tcp dport {{ r.listen_port }} accept
|
|
{% endfor %}
|
|
|
|
# Anything else off the tunnel is not ours. This is the rule that
|
|
# makes "one port, one host" true rather than aspirational.
|
|
iifname "{{ wg_interface }}" counter drop
|
|
|
|
# --- LAN-facing relay listeners -------------------------------------
|
|
{% for r in relays if r.direction == 'outbound' %}
|
|
iifname != "{{ wg_interface }}" ip saddr {{ r.source_allow }} tcp dport {{ r.listen_port }} accept
|
|
tcp dport {{ r.listen_port }} counter drop
|
|
{% endfor %}
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
# Nothing is routed through this box, by design. Combined with
|
|
# net.ipv4.ip_forward=0 this is belt and braces.
|
|
counter
|
|
}
|
|
}
|