RDKCOM-5618: RDKBNETWOR-76 RdkVpnManager: WireGuard firewall rules (IPv4 + IPv6) - #394
Open
sameerunnisa9 wants to merge 2 commits into
Open
RDKCOM-5618: RDKBNETWOR-76 RdkVpnManager: WireGuard firewall rules (IPv4 + IPv6)#394sameerunnisa9 wants to merge 2 commits into
sameerunnisa9 wants to merge 2 commits into
Conversation
Reason for change: Firewall rules to forward the traffic and the port for wireguard communications are added. Test Procedure: Check the firewall rules with the respective traffic flow once the connection is established. Testing Done : Results are captured in RDKBNETWOR-76 Risks: None. Change-Id: I13be7e2c1b945778b611c0c19997886fb7705065 Signed-off-by: Kavita Vakkund <kavita.vakkund@telekom-digital.com>
Expose WireGuard globals for IPv6 path and add tunnel forward, handshake INPUT, and optional IPv6 MASQUERADE using wireguard_local_ipv6. Test Procedure: 1. Enable WireGuard by seing data model 2. Bring up wg0 and establish the tunnel. 3. For IPv6, verify FORWARD/INPUT and POSTROUTING MASQUERADE. 4. Pass traffic through the tunnel and confirm it is forwarded. Signed-off-by: Sameerunnisa S <sameerunnisa.s@telekom-digital.com>
|
📋 PR Format Reminder
Expected: |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Utopia firewall generator to support WireGuard tunnel traffic more completely, including IPv6 handling, by exposing WireGuard-related syscfg globals and emitting additional iptables/ip6tables rules when WireGuard is enabled.
Changes:
- Exposes WireGuard syscfg-backed globals (
wireguard_enabled,wireguard_port,wireguard_local_ipv6) for use across firewall modules. - Adds IPv4 filter rules to allow WireGuard handshake traffic and permit forwarding/input/output on
wg0when enabled. - Adds IPv6 filter rules for handshake + forwarding and an optional IPv6 MASQUERADE rule driven by
wireguard_local_ipv6.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| source/firewall/firewall.h | Exposes WireGuard global configuration strings for cross-module access. |
| source/firewall/firewall.c | Reads WireGuard syscfg values and emits IPv4 WireGuard filter rules. |
| source/firewall/firewall_ipv6.c | Emits IPv6 WireGuard filter rules and optional NAT66 MASQUERADE rule. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| fprintf(filter_fp, "-A FORWARD -i wg0 -j ACCEPT\n"); | ||
| fprintf(filter_fp, "-A INPUT -i wg0 -j ACCEPT\n"); | ||
| fprintf(filter_fp, "-A OUTPUT -o wg0 -j ACCEPT\n"); | ||
| fprintf(filter_fp, "-A INPUT -i erouter0 -p udp --dport %s -j ACCEPT\n",wireguard_port); |
Comment on lines
+3111
to
+3115
| wireguard_port[0] = '\0'; | ||
| rc = syscfg_get(NULL, "Wireguard_Port", wireguard_port, sizeof(wireguard_port)); | ||
| if (0 != rc || '\0' == wireguard_port[0]) { | ||
| snprintf(wireguard_port, sizeof(wireguard_port), "53280"); | ||
| } |
Comment on lines
+559
to
+562
| fprintf(fp, "-I FORWARD -i wg0 -j ACCEPT\n"); | ||
| fprintf(fp, "-I FORWARD -o wg0 -j ACCEPT\n"); | ||
| fprintf(fp, "-I INPUT -i erouter0 -p udp --dport %s -j ACCEPT\n", wireguard_port); | ||
| } |
Comment on lines
+2387
to
+2391
| /* WireGuard: NAT tunnel traffic to WAN so full-tunnel clients reach internet */ | ||
| if (wireguard_enabled[0] == '1' && wireguard_local_ipv6[0] != '\0') { | ||
| fprintf(fp, "-I POSTROUTING -o erouter0 -s %s/64 -j MASQUERADE\n", | ||
| wireguard_local_ipv6); | ||
| } |
pradeeptakdas
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Expose WireGuard globals for IPv6 path and add tunnel forward,
handshake INPUT, and optional IPv6 MASQUERADE using wireguard_local_ipv6.
Test Procedure: