From 36862c86a5455364b68701d19bdf8db564659bae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Murat=20=C3=96ZDEM=C4=B0R?= <muratozdemir@tarla.io>
Date: Fri, 10 Jul 2026 13:54:59 +0300
Subject: [PATCH] feat(wireguard): allow WireGuard UDP port globally via
 firewalld

Removes the IP-based firewall rich rule that restricted WireGuard UDP
access to specific admin CIDRs. This change configures firewalld to allow
the WireGuard port globally, relying on WireGuard's internal cryptographic
key authentication for access control.
---
 ansible/roles/wireguard/tasks/main.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/ansible/roles/wireguard/tasks/main.yml b/ansible/roles/wireguard/tasks/main.yml
index 03ecf01..cefde30 100644
--- a/ansible/roles/wireguard/tasks/main.yml
+++ b/ansible/roles/wireguard/tasks/main.yml
@@ -55,17 +55,25 @@
     state: started
     daemon_reload: true
 
-- name: Allow WireGuard UDP port from admin CIDRs
+- name: Remove old WireGuard UDP port rich rules from admin CIDRs
   ansible.posix.firewalld:
     rich_rule: >-
       rule family="ipv4" source address="{{ item }}"
       port port="{{ wireguard_port }}" protocol="udp" accept
     zone: drop
-    state: enabled
+    state: disabled
     permanent: true
     immediate: true
   loop: "{{ admin_allowed_cidrs.split(' ') }}"
 
+- name: Allow WireGuard UDP port globally (auth via crypt key)
+  ansible.posix.firewalld:
+    port: "{{ wireguard_port }}/udp"
+    zone: drop
+    state: enabled
+    permanent: true
+    immediate: true
+
 - name: Allow DB ports from WireGuard subnet only
   ansible.posix.firewalld:
     rich_rule: >-