rc/network
2
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

firewall: accept VPN connections from inside also

Browse source 
People tend to leave WireGuard tunnels active and we don’t want things
to become unreachable when moving to one of the inside networks.
This commit is contained in:
Timotej Lazar 2024-04-08 15:03:29 +02:00
parent c479f90669
commit 6dcae194d7
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
roles/firewall/templates/nftables.nft.j2
View file

@ -41,8 +41,8 @@ table inet filter {
iif @link udp dport 3784 ip6 saddr fe80::/10 accept \ iif @link udp dport 3784 ip6 saddr fe80::/10 accept \
comment "Accept link-local BFD on fabric links" comment "Accept link-local BFD on fabric links"
iif @outside udp dport 51820 accept \ udp dport 51820 accept \
comment "Accept WireGuard from outside" comment "Accept WireGuard from anywhere"
iif {{ iface_sync }} ip6 saddr fe80::/10 udp dport 3780 accept \ iif {{ iface_sync }} ip6 saddr fe80::/10 udp dport 3780 accept \
comment "Accept connection tracking sync data" comment "Accept connection tracking sync data"