ansible/router
ansible/router
2
0
Fork 0
Code Issues 1 Pull requests Releases Activity

feat: add wireguard exit node

Browse source
This commit is contained in:
Simon Cornet 2026-02-17 14:07:51 +01:00
commit 89c28c593a
1 changed files with 16 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

24
templates/nftables.nft.j2
View file

@ -6,17 +6,17 @@ table inet filter {
chain input { chain input {
type filter hook input priority 0; policy drop; type filter hook input priority 0; policy drop;
# Allow established/related # allow established/related
ct state established,related accept ct state established,related accept
# Allow loopback # allow loopback
iif lo accept iif lo accept
# Allow ICMP # allow icmp
ip protocol icmp accept ip protocol icmp accept
ip6 nexthdr ipv6-icmp accept ip6 nexthdr ipv6-icmp accept
# Allow incoming firewall rules # allow incoming firewall rules
{% for rule in incoming_firewall_rules %} {% for rule in incoming_firewall_rules %}
# {{ rule.name }} # {{ rule.name }}
iif {{ lan_interface }} ip saddr {{ rule.source }} {{ rule.protocol | default('tcp') }} dport {{ rule.port }} accept iif {{ lan_interface }} ip saddr {{ rule.source }} {{ rule.protocol | default('tcp') }} dport {{ rule.port }} accept
@ -26,16 +26,19 @@ table inet filter {
chain forward { chain forward {
type filter hook forward priority 0; policy drop; type filter hook forward priority 0; policy drop;
# Allow established/related # allow established/related
ct state established,related accept ct state established,related accept
{% if wireguard_enabled %} {% if wireguard_enabled %}
# Allow WireGuard traffic # allow wireguard traffic
iifname "wt*" accept iifname "wt*" accept
oifname "wt*" accept oifname "wt*" accept
# allow wireguard to internet (exit node)
iifname "wt*" oif {{ wan_interface }} accept
{% endif %} {% endif %}
# Allow forwarding from LAN to anywhere # allow forwarding from lan to anywhere
iif {{ lan_interface }} oif {{ wan_interface }} accept iif {{ lan_interface }} oif {{ wan_interface }} accept
{% for forward in nat_port_forwards %} {% for forward in nat_port_forwards %}
# {{ forward.name }} # {{ forward.name }}
@ -52,8 +55,13 @@ table ip nat {
chain postrouting { chain postrouting {
type nat hook postrouting priority 100; policy accept; type nat hook postrouting priority 100; policy accept;
# NAT masquerade from LAN to WAN # nat masquerade from lan to wan
iif {{ lan_interface }} oif {{ wan_interface }} masquerade iif {{ lan_interface }} oif {{ wan_interface }} masquerade
{% if wireguard_enabled %}
# nat mascerade from wireguard to wan (exit node)
iifname "wt*" oif {{ wan_interface }} masquerade
{% endif %}
} }
chain prerouting { chain prerouting {