webadmin/bpfire
1
0
Fork 0
mirror of https://github.com/vincentmli/bpfire.git synced 2026-04-09 18:45:54 +02:00
Code Issues Packages Projects Releases Wiki Activity

LoxiLB: enable firewall SNAT for green network

Browse Source 
when loxilb is enabled and started, enable the
firewall SNAT for green network so green network
could have initiate outgoing traffic like internet
access.

we can achieve this by restoring firewall SNAT setting
from default /var/ipfire/loxilb/FWconfig.txt when loxilb
start up with --config-path=/var/ipfire/loxilb thanks
to the enhancement addressed in issue:

https://github.com/loxilb-io/loxilb/issues/706

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
This commit is contained in:
Vincent Li
2024-07-06 23:27:54 +00:00
parent 9f7cd8358f
commit 02724e7427
3 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
config/cfgroot/loxilb-FWconfig.txt Normal file
View File

@@ -0,0 +1 @@
{"fwAttr":[{"opts":{"counter":"0:0","doSnat":true,"toIP":"REDIP"},"ruleArguments":{"destinationIP":"0.0.0.0/0","portName":"green0","sourceIP":"0.0.0.0/0"}}]}

1
lfs/configroot
View File

@@ -104,6 +104,7 @@ $(TARGET) :
cp $(DIR_SRC)/config/cfgroot/udp_ports $(CONFIG_ROOT)/ddos/udp_ports
cp $(DIR_SRC)/config/cfgroot/dns-ddos-settings $(CONFIG_ROOT)/ddos/dns-ddos-settings
cp $(DIR_SRC)/config/cfgroot/loxilb-settings $(CONFIG_ROOT)/loxilb/settings
cp $(DIR_SRC)/config/cfgroot/loxilb-FWconfig.txt $(CONFIG_ROOT)/loxilb/FWconfig.txt
cp $(DIR_SRC)/config/cfgroot/time-settings $(CONFIG_ROOT)/time/settings
cp $(DIR_SRC)/config/cfgroot/logging-settings $(CONFIG_ROOT)/logging/settings
cp $(DIR_SRC)/config/cfgroot/ethernet-vlans $(CONFIG_ROOT)/ethernet/vlans

8
src/initscripts/system/loxilb
View File

@@ -37,13 +37,19 @@ case "$1" in
mkdir -p /opt/loxilb/dp/
mount -t bpf bpf /opt/loxilb/dp/
loadproc -b loxilb --blacklist="eth[0-9]"
#enable egress firewall SNAT for green network
redip=$(< /var/ipfire/red/local-ipaddress)
sed -i "s/\"REDIP\"/\"$redip\"/" /var/ipfire/loxilb/FWconfig.txt
loadproc -b loxilb --config-path="/var/ipfire/loxilb/" --blacklist="eth[0-9]"
fi
;;
stop)
boot_mesg "Stopping loxilb..."
if [ "$ENABLE_LOXILB" == "off" ]; then
#remove egress firewall SNAT for green network
loxicmd delete firewall --firewallRule="portName:green0"
killproc loxilb
fi
;;