octoleo/wireguard-install
1
1
Fork 0
mirror of https://github.com/angristan/wireguard-install.git synced 2024-11-21 20:25:14 +00:00
Code Issues Releases Activity

add firewalld FORWARD rule

Browse Source 
add firewalld FORWARD rule in PostUp & PostDown stage.
This commit is contained in:
Eric_Ren 2024-07-19 11:59:24 +08:00 committed by GitHub
parent 39caf2fcf6
commit bb422716ce
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wireguard-install.sh
View File

@ -237,7 +237,11 @@ PrivateKey = ${SERVER_PRIV_KEY}" >"/etc/wireguard/${SERVER_WG_NIC}.conf"
FIREWALLD_IPV4_ADDRESS=$(echo "${SERVER_WG_IPV4}" | cut -d"." -f1-3)".0"
FIREWALLD_IPV6_ADDRESS=$(echo "${SERVER_WG_IPV6}" | sed 's/:[^:]*$/:0/')
echo "PostUp = firewall-cmd --add-port ${SERVER_PORT}/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'
PostDown = firewall-cmd --remove-port ${SERVER_PORT}/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
PostUp = firewall-cmd --direct --add-rule ipv4 filter FORWARD 1 -i ${SERVER_WG_NIC} -j ACCEPT && firewall-cmd --direct --add-rule ipv4 filter FORWARD 1 -o ${SERVER_WG_NIC} -j ACCEPT
PostUp = firewall-cmd --direct --add-rule ipv6 filter FORWARD 1 -i ${SERVER_WG_NIC} -j ACCEPT && firewall-cmd --direct --add-rule ipv6 filter FORWARD 1 -o ${SERVER_WG_NIC} -j ACCEPT
PostDown = firewall-cmd --remove-port ${SERVER_PORT}/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'
PostDown = firewall-cmd --direct --remove-rule ipv4 filter FORWARD 1 -i ${SERVER_WG_NIC} -j ACCEPT && firewall-cmd --direct --remove-rule ipv4 filter FORWARD 1 -o ${SERVER_WG_NIC} -j ACCEPT
PostDown = firewall-cmd --direct --remove-rule ipv6 filter FORWARD 1 -i ${SERVER_WG_NIC} -j ACCEPT && firewall-cmd --direct --remove-rule ipv6 filter FORWARD 1 -o ${SERVER_WG_NIC} -j ACCEPT" >>"/etc/wireguard/${SERVER_WG_NIC}.conf "
else
echo "PostUp = iptables -I INPUT -p udp --dport ${SERVER_PORT} -j ACCEPT
PostUp = iptables -I FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT