Skip to content

RDKCOM-5618: RDKBNETWOR-76 Firewall rules to support wireguard tunnel. #376

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pradeeptakdas wants to merge 1 commit into
base: develop
Choose a base branch
from
+21 −0
Open

RDKCOM-5618: RDKBNETWOR-76 Firewall rules to support wireguard tunnel. #376

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions source/firewall/firewall.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -647,6 +647,8 @@ static char transparent_cache_state[10]; // state of the transparent http cache
static char byoi_bridge_mode[10]; // whether or not byoi is in bridge mode
static char cmdiag_enabled[20]; // If eCM diagnostic Interface Enabled
static char firewall_level[20]; // None, Low, Medium, High, or Custom
static char wireguard_enabled[4]; // Wireguard configuration
static char wireguard_port[8];
static char natip4[20];
static char captivePortalEnabled[50]; //to ccheck captive portal is enabled or not

Expand Down Expand Up @@ -3090,6 +3092,17 @@ static int prepare_globals_from_configuration(void)
rc = syscfg_get(NULL, "http_admin_port", reserved_mgmt_port, sizeof(reserved_mgmt_port));
if (0 != rc || '\0' == reserved_mgmt_port[0]) {
snprintf(reserved_mgmt_port, sizeof(reserved_mgmt_port), "80");
}

wireguard_enabled[0] = '\0';
rc = syscfg_get(NULL, "wireguard_enabled", wireguard_enabled, sizeof(wireguard_enabled));
if (0 != rc || '\0' == wireguard_enabled[0]) {
snprintf(wireguard_enabled, sizeof(wireguard_enabled), "0");
}
wireguard_port[0] = '\0';
rc = syscfg_get(NULL, "Wireguard_Port", wireguard_port, sizeof(wireguard_port));
if (0 != rc || '\0' == wireguard_port[0]) {
snprintf(wireguard_port, sizeof(wireguard_port), "53280");
}
Comment on lines +3102 to 3106

/* Get DSCP value for gre */
Expand Down Expand Up @@ -12428,6 +12441,14 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE *
fprintf(filter_fp, "-A FORWARD -j pp_disabled\n");
#endif

if(wireguard_enabled[0] == '1') {
fprintf(filter_fp, "-A FORWARD -o wg0 -j ACCEPT\n");
fprintf(filter_fp, "-A FORWARD -i wg0 -j ACCEPT\n");
fprintf(filter_fp, "-A INPUT -i wg0 -j ACCEPT\n");
fprintf(filter_fp, "-A OUTPUT -o wg0 -j ACCEPT\n");
Comment on lines +12444 to +12448
fprintf(filter_fp, "-A INPUT -i erouter0 -p udp --dport %s -j ACCEPT\n",wireguard_port);
}
Comment on lines +12447 to +12450

fprintf(filter_fp, ":%s - [0:0]\n", "lan2wan");

#ifdef CONFIG_CISCO_FEATURE_CISCOCONNECT
Expand Down
Loading