zishuo/netmaker
1
0
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-10-06 09:22:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

add ip6table rules for gateways

Browse Source
This commit is contained in:
Matthew R. Kasun
2022-09-01 08:10:49 -04:00
parent 16a653d34c
commit ea3a1933e1
4 changed files with 76 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
logic/gateway.go
View File

@@ -37,6 +37,7 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
node.EgressGatewayRequest = gateway // store entire request for use when preserving the egress gateway node.EgressGatewayRequest = gateway // store entire request for use when preserving the egress gateway
postUpCmd := "" postUpCmd := ""
postDownCmd := "" postDownCmd := ""
ipv4, ipv6 := getNetworkProtocols(gateway.Ranges)
logger.Log(3, "creating egress gateway firewall in use is '", node.FirewallInUse, "'") logger.Log(3, "creating egress gateway firewall in use is '", node.FirewallInUse, "'")
if node.OS == "linux" { if node.OS == "linux" {
switch node.FirewallInUse { switch node.FirewallInUse {
@@ -52,7 +53,7 @@ func CreateEgressGateway(gateway models.EgressGatewayRequest) (models.Node, erro
default: // iptables assumed default: // iptables assumed
logger.Log(3, "creating egress gateway nftables is not present") logger.Log(3, "creating egress gateway nftables is not present")
postUpCmd, postDownCmd = firewallIPTablesCommandsCreateEgress(node.Interface, gateway.Interface, node.EgressGatewayNatEnabled) postUpCmd, postDownCmd = firewallIPTablesCommandsCreateEgress(node.Interface, gateway.Interface, node.EgressGatewayNatEnabled, ipv4, ipv6)
} }
} }
if node.OS == "freebsd" { if node.OS == "freebsd" {
@@ -180,7 +181,9 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
return models.Node{}, err return models.Node{}, err
} }
node.IsIngressGateway = "yes" node.IsIngressGateway = "yes"
node.IngressGatewayRange = network.AddressRange node.IngressGatewayRange = append(node.IngressGatewayRange, network.AddressRange)
node.IngressGatewayRange = append(node.IngressGatewayRange, network.AddressRange6)
ipv4, ipv6 = getNetworkProtocols(node.IngressGatewayRange)
logger.Log(3, "creating ingress gateway firewall in use is '", node.FirewallInUse, "'") logger.Log(3, "creating ingress gateway firewall in use is '", node.FirewallInUse, "'")
switch node.FirewallInUse { switch node.FirewallInUse {
case models.FIREWALL_NFTABLES: case models.FIREWALL_NFTABLES:
@@ -190,7 +193,7 @@ func CreateIngressGateway(netid string, nodeid string) (models.Node, error) {
postUpCmd, postDownCmd = firewallNFTCommandsCreateIngress(node.Interface) postUpCmd, postDownCmd = firewallNFTCommandsCreateIngress(node.Interface)
default: default:
logger.Log(3, "creating ingress gateway using nftables is not present") logger.Log(3, "creating ingress gateway using nftables is not present")
postUpCmd, postDownCmd = firewallIPTablesCommandsCreateIngress(node.Interface) postUpCmd, postDownCmd = firewallIPTablesCommandsCreateIngress(node.Interface, ipv4, ipv6)
} }
if node.PostUp != "" { if node.PostUp != "" {
@@ -331,33 +334,61 @@ func firewallNFTCommandsCreateEgress(networkInterface string, gatewayInterface s
} }
// firewallIPTablesCommandsCreateIngress - used to centralize firewall command maintenance for creating an ingress gateway using the iptables firewall. // firewallIPTablesCommandsCreateIngress - used to centralize firewall command maintenance for creating an ingress gateway using the iptables firewall.
func firewallIPTablesCommandsCreateIngress(networkInterface string) (string, string) { func firewallIPTablesCommandsCreateIngress(networkInterface string, ipv4, ipv6 bool) (string, string) {
// spacing around ; is important for later parsing of postup/postdown in wireguard/common.go postUp := ""
postUp := "iptables -A FORWARD -i " + networkInterface + " -j ACCEPT ; " postDown := ""
postUp += "iptables -A FORWARD -o " + networkInterface + " -j ACCEPT ; " if ipv4 {
postUp += "iptables -t nat -A POSTROUTING -o " + networkInterface + " -j MASQUERADE" // spacing around ; is important for later parsing of postup/postdown in wireguard/common.go
postUp += "iptables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
postUp += "iptables -A FORWARD -o " + networkInterface + " -j ACCEPT ; "
postUp += "iptables -t nat -A POSTROUTING -o " + networkInterface + " -j MASQUERADE"
// doesn't remove potentially empty tables or chains // doesn't remove potentially empty tables or chains
postDown := "iptables -D FORWARD -i " + networkInterface + " -j ACCEPT ; " postDown += "iptables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
postDown += "iptables -D FORWARD -o " + networkInterface + " -j ACCEPT ; " postDown += "iptables -D FORWARD -o " + networkInterface + " -j ACCEPT ; "
postDown += "iptables -t nat -D POSTROUTING -o " + networkInterface + " -j MASQUERADE" postDown += "iptables -t nat -D POSTROUTING -o " + networkInterface + " -j MASQUERADE"
}
if ipv6 {
// spacing around ; is important for later parsing of postup/postdown in wireguard/common.go
postUp += "ip6tables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
postUp += "ip6tables -A FORWARD -o " + networkInterface + " -j ACCEPT ; "
postUp += "ip6tables -t nat -A POSTROUTING -o " + networkInterface + " -j MASQUERADE"
// doesn't remove potentially empty tables or chains
postDown += "ip6tables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
postDown += "ip6tables -D FORWARD -o " + networkInterface + " -j ACCEPT ; "
postDown += "ip6tables -t nat -D POSTROUTING -o " + networkInterface + " -j MASQUERADE"
}
return postUp, postDown return postUp, postDown
} }
// firewallIPTablesCommandsCreateEgress - used to centralize firewall command maintenance for creating an egress gateway using the iptables firewall. // firewallIPTablesCommandsCreateEgress - used to centralize firewall command maintenance for creating an egress gateway using the iptables firewall.
func firewallIPTablesCommandsCreateEgress(networkInterface string, gatewayInterface string, egressNatEnabled string) (string, string) { func firewallIPTablesCommandsCreateEgress(networkInterface string, gatewayInterface string, egressNatEnabled string, ipv4, ipv6 bool) (string, string) {
// spacing around ; is important for later parsing of postup/postdown in wireguard/common.go // spacing around ; is important for later parsing of postup/postdown in wireguard/common.go
postUp := "iptables -A FORWARD -i " + networkInterface + " -j ACCEPT ; " postUp := ""
postUp += "iptables -A FORWARD -o " + networkInterface + " -j ACCEPT" postDown := ""
postDown := "iptables -D FORWARD -i " + networkInterface + " -j ACCEPT ; " if ipv4 {
postDown += "iptables -D FORWARD -o " + networkInterface + " -j ACCEPT" postUp += "iptables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
postUp += "iptables -A FORWARD -o " + networkInterface + " -j ACCEPT"
postDown += "iptables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
postDown += "iptables -D FORWARD -o " + networkInterface + " -j ACCEPT"
if egressNatEnabled == "yes" { if egressNatEnabled == "yes" {
postUp += " ; iptables -t nat -A POSTROUTING -o " + gatewayInterface + " -j MASQUERADE" postUp += " ; iptables -t nat -A POSTROUTING -o " + gatewayInterface + " -j MASQUERADE"
postDown += " ; iptables -t nat -D POSTROUTING -o " + gatewayInterface + " -j MASQUERADE" postDown += " ; iptables -t nat -D POSTROUTING -o " + gatewayInterface + " -j MASQUERADE"
}
} }
if ipv6 {
postUp += "ip6tables -A FORWARD -i " + networkInterface + " -j ACCEPT ; "
postUp += "ip6tables -A FORWARD -o " + networkInterface + " -j ACCEPT"
postDown += "ip6tables -D FORWARD -i " + networkInterface + " -j ACCEPT ; "
postDown += "ip6tables -D FORWARD -o " + networkInterface + " -j ACCEPT"
if egressNatEnabled == "yes" {
postUp += " ; ip6tables -t nat -A POSTROUTING -o " + gatewayInterface + " -j MASQUERADE"
postDown += " ; ip6tables -t nat -D POSTROUTING -o " + gatewayInterface + " -j MASQUERADE"
}
}
return postUp, postDown return postUp, postDown
} }

17
logic/util.go
View File

@@ -169,3 +169,20 @@ func ShouldPublishPeerPorts(serverNode *models.Node) bool {
} }
return false return false
} }
func getNetworkProtocols(cidrs []string) (bool, bool) {
ipv4 := false
ipv6 := false
for _, cidr := range cidrs {
ip, _, err := net.ParseCIDR(cidr)
if err != nil {
continue
}
if ip.To4() == nil {
ipv6 = true
} else {
ipv4 = true
}
}
return ipv4, ipv6
}

2
models/node.go
View File

@@ -76,7 +76,7 @@ type Node struct {
EgressGatewayNatEnabled string `json:"egressgatewaynatenabled" bson:"egressgatewaynatenabled" yaml:"egressgatewaynatenabled"` EgressGatewayNatEnabled string `json:"egressgatewaynatenabled" bson:"egressgatewaynatenabled" yaml:"egressgatewaynatenabled"`
EgressGatewayRequest EgressGatewayRequest `json:"egressgatewayrequest" bson:"egressgatewayrequest" yaml:"egressgatewayrequest"` EgressGatewayRequest EgressGatewayRequest `json:"egressgatewayrequest" bson:"egressgatewayrequest" yaml:"egressgatewayrequest"`
RelayAddrs []string `json:"relayaddrs" bson:"relayaddrs" yaml:"relayaddrs"` RelayAddrs []string `json:"relayaddrs" bson:"relayaddrs" yaml:"relayaddrs"`
IngressGatewayRange string `json:"ingressgatewayrange" bson:"ingressgatewayrange" yaml:"ingressgatewayrange"` IngressGatewayRange []string `json:"ingressgatewayrange" bson:"ingressgatewayrange" yaml:"ingressgatewayrange"`
// IsStatic - refers to if the Endpoint is set manually or dynamically // IsStatic - refers to if the Endpoint is set manually or dynamically
IsStatic string `json:"isstatic" bson:"isstatic" yaml:"isstatic" validate:"checkyesorno"` IsStatic string `json:"isstatic" bson:"isstatic" yaml:"isstatic" validate:"checkyesorno"`
UDPHolePunch string `json:"udpholepunch" bson:"udpholepunch" yaml:"udpholepunch" validate:"checkyesorno"` UDPHolePunch string `json:"udpholepunch" bson:"udpholepunch" yaml:"udpholepunch" validate:"checkyesorno"`

15
models/structs.go
View File

@@ -146,14 +146,13 @@ type ExtPeersResponse struct {
// EgressGatewayRequest - egress gateway request // EgressGatewayRequest - egress gateway request
type EgressGatewayRequest struct { type EgressGatewayRequest struct {
NodeID string `json:"nodeid" bson:"nodeid"` NodeID string `json:"nodeid" bson:"nodeid"`
NetID string `json:"netid" bson:"netid"` NetID string `json:"netid" bson:"netid"`
RangeString string `json:"rangestring" bson:"rangestring"` NatEnabled string `json:"natenabled" bson:"natenabled"`
NatEnabled string `json:"natenabled" bson:"natenabled"` Ranges []string `json:"ranges" bson:"ranges"`
Ranges []string `json:"ranges" bson:"ranges"` Interface string `json:"interface" bson:"interface"`
Interface string `json:"interface" bson:"interface"` PostUp string `json:"postup" bson:"postup"`
PostUp string `json:"postup" bson:"postup"` PostDown string `json:"postdown" bson:"postdown"`
PostDown string `json:"postdown" bson:"postdown"`
} }
// RelayRequest - relay request struct // RelayRequest - relay request struct