network/roles/firewall/templates/wg.intf.j2
Timotej Lazar 6840838978 firewall: ensure wireguard egress traffic uses the anycast source IP
Before we relied on the IP being first in the interfaces file, which
is less than optimal. Now we use nftables to ensure the correct source
IP is set only for the (fwmarked) wireguard traffic.

Also remove iface hints from interfaces configuration as they are not
needed with ifupdown-ng.
2025-07-18 18:35:36 +02:00

12 lines
199 B
Django/Jinja

iface lo
address {{ wg_ip }}
auto wg
iface wg
use wireguard
{% if wg_net is defined %}
address {{ wg_net }}
{% endif %}
{% if wg_net6 is defined %}
address {{ wg_net6 }}
{% endif %}