Bernd Storath
4 months ago
No known key found for this signature in database
GPG Key ID: D6C85685A555540F
2 changed files with
2 additions and
6 deletions
-
Dockerfile
-
docs/content/examples/tutorials/podman-nft.md
|
|
|
@ -34,6 +34,7 @@ RUN apk add --no-cache \ |
|
|
|
dumb-init \ |
|
|
|
iptables \ |
|
|
|
ip6tables \ |
|
|
|
nftables \ |
|
|
|
kmod \ |
|
|
|
iptables-legacy \ |
|
|
|
wireguard-tools |
|
|
|
|
|
|
|
@ -2,11 +2,6 @@ |
|
|
|
title: Podman + nftables |
|
|
|
--- |
|
|
|
|
|
|
|
/// warning | Not working yet |
|
|
|
|
|
|
|
There are some problems with nftables currently. You can use the Quadlet files anyway |
|
|
|
/// |
|
|
|
|
|
|
|
This guide will show you how to run `wg-easy` with rootful Podman and nftables. |
|
|
|
|
|
|
|
## Requirements |
|
|
|
@ -93,7 +88,7 @@ In the Admin Panel of your WireGuard server, go to the `Hooks` tab and add the f |
|
|
|
1. PostUp |
|
|
|
|
|
|
|
```shell |
|
|
|
apk add nftables; nft add table inet wg_table; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy accept \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy accept \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept; |
|
|
|
nft add table inet wg_table; nft add chain inet wg_table prerouting { type nat hook prerouting priority 100 \; }; nft add chain inet wg_table postrouting { type nat hook postrouting priority 100 \; }; nft add rule inet wg_table postrouting ip saddr {{ipv4Cidr}} oifname {{device}} masquerade; nft add rule inet wg_table postrouting ip6 saddr {{ipv6Cidr}} oifname {{device}} masquerade; nft add chain inet wg_table input { type filter hook input priority 0 \; policy accept \; }; nft add rule inet wg_table input udp dport {{port}} accept; nft add rule inet wg_table input tcp dport {{uiPort}} accept; nft add chain inet wg_table forward { type filter hook forward priority 0 \; policy accept \; }; nft add rule inet wg_table forward iifname "wg0" accept; nft add rule inet wg_table forward oifname "wg0" accept; |
|
|
|
``` |
|
|
|
|
|
|
|
2. PostDown |
|
|
|
|
