From 51d1adf4f1d8b85aed594cfd22defa3c2d7dca59 Mon Sep 17 00:00:00 2001 From: Kavita Vakkund Date: Tue, 29 Jul 2025 04:38:00 +0000 Subject: [PATCH 1/2] RDKBNETWOR-76 : Firewall rules to support wireguard tunnel. Reason for change: Firewall rules to forward the traffic and the port for wireguard communications are added. Test Procedure: Check the firewall rules with the respective traffic flow once the connection is established. Testing Done : Results are captured in RDKBNETWOR-76 Risks: None. Change-Id: I13be7e2c1b945778b611c0c19997886fb7705065 Signed-off-by: Kavita Vakkund --- source/firewall/firewall.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 950a7d9d..7f65d2d8 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -647,6 +647,8 @@ static char transparent_cache_state[10]; // state of the transparent http cache static char byoi_bridge_mode[10]; // whether or not byoi is in bridge mode static char cmdiag_enabled[20]; // If eCM diagnostic Interface Enabled static char firewall_level[20]; // None, Low, Medium, High, or Custom +static char wireguard_enabled[4]; // Wireguard configuration +static char wireguard_port[8]; static char natip4[20]; static char captivePortalEnabled[50]; //to ccheck captive portal is enabled or not @@ -3098,6 +3100,17 @@ static int prepare_globals_from_configuration(void) rc = syscfg_get(NULL, "http_admin_port", reserved_mgmt_port, sizeof(reserved_mgmt_port)); if (0 != rc || '\0' == reserved_mgmt_port[0]) { snprintf(reserved_mgmt_port, sizeof(reserved_mgmt_port), "80"); + } + + wireguard_enabled[0] = '\0'; + rc = syscfg_get(NULL, "wireguard_enabled", wireguard_enabled, sizeof(wireguard_enabled)); + if (0 != rc || '\0' == wireguard_enabled[0]) { + snprintf(wireguard_enabled, sizeof(wireguard_enabled), "0"); + } + wireguard_port[0] = '\0'; + rc = syscfg_get(NULL, "Wireguard_Port", wireguard_port, sizeof(wireguard_port)); + if (0 != rc || '\0' == wireguard_port[0]) { + snprintf(wireguard_port, sizeof(wireguard_port), "53280"); } /* Get DSCP value for gre */ @@ -12475,6 +12488,14 @@ static int prepare_subtables(FILE *raw_fp, FILE *mangle_fp, FILE *nat_fp, FILE * fprintf(filter_fp, "-A FORWARD -j pp_disabled\n"); #endif + if(wireguard_enabled[0] == '1') { + fprintf(filter_fp, "-A FORWARD -o wg0 -j ACCEPT\n"); + fprintf(filter_fp, "-A FORWARD -i wg0 -j ACCEPT\n"); + fprintf(filter_fp, "-A INPUT -i wg0 -j ACCEPT\n"); + fprintf(filter_fp, "-A OUTPUT -o wg0 -j ACCEPT\n"); + fprintf(filter_fp, "-A INPUT -i erouter0 -p udp --dport %s -j ACCEPT\n",wireguard_port); + } + fprintf(filter_fp, ":%s - [0:0]\n", "lan2wan"); #ifdef CONFIG_CISCO_FEATURE_CISCOCONNECT From e449fec40f5ca640c8ddd10c0c3daa16757d8fe2 Mon Sep 17 00:00:00 2001 From: Sameerunnisa S Date: Mon, 3 Aug 2026 12:05:51 +0000 Subject: [PATCH 2/2] WireGuard IPv6 firewall/NAT support on top of RDKBNETWOR-76 Expose WireGuard globals for IPv6 path and add tunnel forward, handshake INPUT, and optional IPv6 MASQUERADE using wireguard_local_ipv6. Test Procedure: 1. Enable WireGuard by seing data model 2. Bring up wg0 and establish the tunnel. 3. For IPv6, verify FORWARD/INPUT and POSTROUTING MASQUERADE. 4. Pass traffic through the tunnel and confirm it is forwarded. Signed-off-by: Sameerunnisa S --- source/firewall/firewall.c | 9 ++++++--- source/firewall/firewall.h | 3 +++ source/firewall/firewall_ipv6.c | 14 ++++++++++++++ 3 files changed, 23 insertions(+), 3 deletions(-) diff --git a/source/firewall/firewall.c b/source/firewall/firewall.c index 7f65d2d8..670bb54d 100644 --- a/source/firewall/firewall.c +++ b/source/firewall/firewall.c @@ -647,8 +647,9 @@ static char transparent_cache_state[10]; // state of the transparent http cache static char byoi_bridge_mode[10]; // whether or not byoi is in bridge mode static char cmdiag_enabled[20]; // If eCM diagnostic Interface Enabled static char firewall_level[20]; // None, Low, Medium, High, or Custom -static char wireguard_enabled[4]; // Wireguard configuration -static char wireguard_port[8]; +char wireguard_enabled[4]; // Wireguard configuration +char wireguard_port[8]; +char wireguard_local_ipv6[128]; static char natip4[20]; static char captivePortalEnabled[50]; //to ccheck captive portal is enabled or not @@ -3111,7 +3112,9 @@ static int prepare_globals_from_configuration(void) rc = syscfg_get(NULL, "Wireguard_Port", wireguard_port, sizeof(wireguard_port)); if (0 != rc || '\0' == wireguard_port[0]) { snprintf(wireguard_port, sizeof(wireguard_port), "53280"); - } + } + wireguard_local_ipv6[0] = '\0'; + syscfg_get(NULL, "wireguard_local_ipv6", wireguard_local_ipv6, sizeof(wireguard_local_ipv6)); /* Get DSCP value for gre */ if(bus_handle != NULL){ diff --git a/source/firewall/firewall.h b/source/firewall/firewall.h index abfd63c3..da5bd960 100644 --- a/source/firewall/firewall.h +++ b/source/firewall/firewall.h @@ -963,6 +963,9 @@ extern token_t sysevent_token; extern char *sysevent_name; extern int syslog_level; extern char firewall_levelv6[20]; +extern char wireguard_enabled[4]; +extern char wireguard_port[8]; +extern char wireguard_local_ipv6[128]; extern int isWanPingDisableV6; extern int isHttpBlockedV6; extern int isP2pBlockedV6; diff --git a/source/firewall/firewall_ipv6.c b/source/firewall/firewall_ipv6.c index 830e9f73..0783c482 100644 --- a/source/firewall/firewall_ipv6.c +++ b/source/firewall/firewall_ipv6.c @@ -553,6 +553,14 @@ void do_ipv6_filter_table(FILE *fp){ fprintf(fp, "-A FORWARD -i a-mux -j ACCEPT\n"); #endif + /* WireGuard IPv6 (mirror IPv4): handshake + tunnel forward. + * INPUT UDP must beat wan2self's "-p udp -j DROP". */ + if (wireguard_enabled[0] == '1') { + fprintf(fp, "-I FORWARD -i wg0 -j ACCEPT\n"); + fprintf(fp, "-I FORWARD -o wg0 -j ACCEPT\n"); + fprintf(fp, "-I INPUT -i erouter0 -p udp --dport %s -j ACCEPT\n", wireguard_port); + } + fprintf(fp, ":%s - [0:0]\n", "LOG_INPUT_DROP"); fprintf(fp, ":%s - [0:0]\n", "LOG_FORWARD_DROP"); if(isComcastImage) { @@ -2376,6 +2384,12 @@ void do_ipv6_nat_table(FILE* fp) fprintf(fp, "-A POSTROUTING -o %s -j MASQUERADE\n", current_wan_ifname); #endif + /* WireGuard: NAT tunnel traffic to WAN so full-tunnel clients reach internet */ + if (wireguard_enabled[0] == '1' && wireguard_local_ipv6[0] != '\0') { + fprintf(fp, "-I POSTROUTING -o erouter0 -s %s/64 -j MASQUERADE\n", + wireguard_local_ipv6); + } + FIREWALL_DEBUG("Exiting do_ipv6_nat_table \n"); }