f99d5e8656
- Accept output traffic from all default routes through VPN interface - Accept output from all default routes to outbound subnets - Accept all input traffic on ports for all default routes - Add IP rules for all default routes
65 lines
1.6 KiB
Go
65 lines
1.6 KiB
Go
package firewall
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/qdm12/gluetun/internal/models"
|
|
)
|
|
|
|
type VPNConnectionSetter interface {
|
|
SetVPNConnection(ctx context.Context,
|
|
connection models.Connection, vpnIntf string) error
|
|
}
|
|
|
|
func (c *Config) SetVPNConnection(ctx context.Context,
|
|
connection models.Connection, vpnIntf string) (err error) {
|
|
c.stateMutex.Lock()
|
|
defer c.stateMutex.Unlock()
|
|
|
|
if !c.enabled {
|
|
c.logger.Info("firewall disabled, only updating internal VPN connection")
|
|
c.vpnConnection = connection
|
|
return nil
|
|
}
|
|
|
|
c.logger.Info("allowing VPN connection...")
|
|
|
|
if c.vpnConnection.Equal(connection) {
|
|
return nil
|
|
}
|
|
|
|
remove := true
|
|
if c.vpnConnection.IP != nil {
|
|
for _, defaultRoute := range c.defaultRoutes {
|
|
if err := c.acceptOutputTrafficToVPN(ctx, defaultRoute.NetInterface, c.vpnConnection, remove); err != nil {
|
|
c.logger.Error("cannot remove outdated VPN connection rule: " + err.Error())
|
|
}
|
|
}
|
|
}
|
|
c.vpnConnection = models.Connection{}
|
|
|
|
if c.vpnIntf != "" {
|
|
if err = c.acceptOutputThroughInterface(ctx, c.vpnIntf, remove); err != nil {
|
|
c.logger.Error("cannot remove outdated VPN interface rule: " + err.Error())
|
|
}
|
|
}
|
|
c.vpnIntf = ""
|
|
|
|
remove = false
|
|
|
|
for _, defaultRoute := range c.defaultRoutes {
|
|
if err := c.acceptOutputTrafficToVPN(ctx, defaultRoute.NetInterface, connection, remove); err != nil {
|
|
return fmt.Errorf("cannot allow output traffic through VPN connection: %w", err)
|
|
}
|
|
}
|
|
c.vpnConnection = connection
|
|
|
|
if err = c.acceptOutputThroughInterface(ctx, vpnIntf, remove); err != nil {
|
|
return fmt.Errorf("cannot accept output traffic through interface %s: %w", vpnIntf, err)
|
|
}
|
|
c.vpnIntf = vpnIntf
|
|
|
|
return nil
|
|
}
|