Development discussion of WireGuard
 help / color / mirror / Atom feed
* [PATCH] man: wg-quick: kill-switch rules for firewalld
@ 2022-07-23 21:32 Sotir Danailov
  0 siblings, 0 replies; only message in thread
From: Sotir Danailov @ 2022-07-23 21:32 UTC (permalink / raw)
  To: Jason; +Cc: wireguard, Sotir Danailov

Signed-off-by: Sotir Danailov <sndanailov@gmail.com>
---
 src/man/wg-quick.8 | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/man/wg-quick.8 b/src/man/wg-quick.8
index b84eb64..9f8414e 100644
--- a/src/man/wg-quick.8
+++ b/src/man/wg-quick.8
@@ -156,6 +156,13 @@ two lines `PostUp` and `PreDown` lines to the `[Interface]` section:
     \fBPreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT\fP
 .br
 
+When using `firewalld', the ``kill-switch'' can be done like so:
+
+    \fBPostUp = firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && firewall-cmd --reload\fP
+.br
+    \fBPreDown = firewall-cmd --permanent --direct --remove-rule ipv4 filter OUTPUT 0 ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && firewall-cmd --reload\fP
+.br
+
 The `PostUp' and `PreDown' fields have been added to specify an
 .BR iptables (8)
 command which, when used with interfaces that have a peer that specifies 0.0.0.0/0 as part of the
-- 
2.37.1


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2022-07-26 13:12 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-23 21:32 [PATCH] man: wg-quick: kill-switch rules for firewalld Sotir Danailov

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).