diff options
Diffstat (limited to 'frontends')
| -rw-r--r-- | frontends/Rexfile | 17 | ||||
| -rw-r--r-- | frontends/etc/pf.conf.tpl | 27 |
2 files changed, 44 insertions, 0 deletions
diff --git a/frontends/Rexfile b/frontends/Rexfile index 0d7bc4f..5194265 100644 --- a/frontends/Rexfile +++ b/frontends/Rexfile @@ -631,6 +631,22 @@ task 'ircbouncer', service 'znc', ensure => 'started'; }; +desc 'Setup PF firewall with WireGuard NAT rules'; +task 'pf', + group => 'frontends', + sub { + # Deploy pf.conf with NAT rules for WireGuard VPN clients + file '/etc/pf.conf', + content => template('./etc/pf.conf.tpl'), + owner => 'root', + group => 'wheel', + mode => '600', + on_change => sub { + # Reload PF configuration + run 'pfctl -f /etc/pf.conf'; + }; + }; + # COMBINED TASKS SECTION desc 'Common configs of all hosts'; @@ -638,6 +654,7 @@ task 'commons', group => 'frontends', sub { run_task 'base'; + run_task 'pf'; run_task 'nsd'; run_task 'nsd_failover'; run_task 'uptimed'; diff --git a/frontends/etc/pf.conf.tpl b/frontends/etc/pf.conf.tpl new file mode 100644 index 0000000..24c007e --- /dev/null +++ b/frontends/etc/pf.conf.tpl @@ -0,0 +1,27 @@ +# $OpenBSD: pf.conf,v 1.55 2017/12/03 20:40:04 sthen Exp $ +# +# See pf.conf(5) and /etc/examples/pf.conf + +# NAT for WireGuard clients to access internet +# This allows roaming clients (earth, pixel7pro) to route all traffic +# through the VPN and access the internet via the gateway's public IP +match out on vio0 from 192.168.2.0/24 to any nat-to (vio0) + +set skip on lo + +block return # block stateless traffic +pass # establish keep-state + +# By default, do not permit remote connections to X11 +block return in on ! lo0 proto tcp to port 6000:6010 + +# Port build user does not need network +block return out log proto {tcp udp} user _pbuild + +# Allow inbound traffic on WireGuard interface +# This permits traffic from VPN clients to access services on this host +pass in on wg0 + +# Allow all UDP traffic on WireGuard port +# This is required for WireGuard's encrypted tunnel communication +pass in inet proto udp from any to any port 56709 |