WEBDIENSTE/algo
1
0
Fork 0
mirror of https://github.com/trailofbits/algo.git synced 2026-09-12 20:57:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix IPsec DNS when WireGuard uses port 53 (#1719)

Browse Source 
* Fix IPsec DNS when WireGuard uses port 53

* Change ACCEPT to RETURN
This commit is contained in:
David Myers
2020-02-25 07:43:25 +01:00
committed by GitHub
parent 28d95eace2
commit 3f3138f555
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/common/templates/rules.v4.j2
+1
View File
@@ -32,6 +32,7 @@ COMMIT
{% if wireguard_enabled and wireguard_port|int == wireguard_port_avoid|int %}
# Handle the special case of allowing access to WireGuard over an already used
# port like 53
-A PREROUTING -s {{ subnets|join(',') }} -p udp --dport {{ wireguard_port_avoid }} -j RETURN
-A PREROUTING --in-interface {{ ansible_default_ipv4['interface'] }} -p udp --dport {{ wireguard_port_avoid }} -j REDIRECT --to-port {{ wireguard_port_actual }}
{% endif %}
# Allow traffic from the VPN network to the outside world, and replies
roles/common/templates/rules.v6.j2
+1
View File
@@ -31,6 +31,7 @@ COMMIT
{% if wireguard_enabled and wireguard_port|int == wireguard_port_avoid|int %}
# Handle the special case of allowing access to WireGuard over an already used
# port like 53
-A PREROUTING -s {{ subnets|join(',') }} -p udp --dport {{ wireguard_port_avoid }} -j RETURN
-A PREROUTING --in-interface {{ ansible_default_ipv6['interface'] }} -p udp --dport {{ wireguard_port_avoid }} -j REDIRECT --to-port {{ wireguard_port_actual }}
{% endif %}
# Allow traffic from the VPN network to the outside world, and replies