iklim.co/Environment_Infrastructure
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(wireguard): allow WireGuard UDP port globally via firewalld

Browse Source 
Removes the IP-based firewall rich rule that restricted WireGuard UDP
access to specific admin CIDRs. This change configures firewalld to allow
the WireGuard port globally, relying on WireGuard's internal cryptographic
key authentication for access control.
This commit is contained in:
Murat ÖZDEMİR 2026-07-10 13:54:59 +03:00
parent 244b1c0d4a
commit 36862c86a5
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
ansible/roles/wireguard/tasks/main.yml
View File

@ -55,17 +55,25 @@
state: started state: started
daemon_reload: true daemon_reload: true
- name: Allow WireGuard UDP port from admin CIDRs - name: Remove old WireGuard UDP port rich rules from admin CIDRs
ansible.posix.firewalld: ansible.posix.firewalld:
rich_rule: >- rich_rule: >-
rule family="ipv4" source address="{{ item }}" rule family="ipv4" source address="{{ item }}"
port port="{{ wireguard_port }}" protocol="udp" accept port port="{{ wireguard_port }}" protocol="udp" accept
zone: drop zone: drop
state: enabled state: disabled
permanent: true permanent: true
immediate: true immediate: true
loop: "{{ admin_allowed_cidrs.split(' ') }}" loop: "{{ admin_allowed_cidrs.split(' ') }}"
- name: Allow WireGuard UDP port globally (auth via crypt key)
ansible.posix.firewalld:
port: "{{ wireguard_port }}/udp"
zone: drop
state: enabled
permanent: true
immediate: true
- name: Allow DB ports from WireGuard subnet only - name: Allow DB ports from WireGuard subnet only
ansible.posix.firewalld: ansible.posix.firewalld:
rich_rule: >- rich_rule: >-