WireGuard Archive on lore.kernel.org
 help / Atom feed
* Option to fwmark incoming packets?
@ 2018-12-06 17:41 Matthias Urlichs
  0 siblings, 0 replies; 1+ messages in thread
From: Matthias Urlichs @ 2018-12-06 17:41 UTC (permalink / raw)
  To: WireGuard mailing list

[-- Attachment #1.1: Type: text/plain, Size: 436 bytes --]

Hi,

I seem to require firewalling some peers' incoming traffic with special rules.

While it's certainly possible to add a bunch of iptables/nftables rules to
classify traffic from the WG interface (just mirror the peers' AllowedIP
entries …) this is redundant (thus possibly inconsistent) and bad for
performance.

How about a per-peer "fwmark" setting that marks that peer's incoming packets?

-- 
-- Matthias Urlichs

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[-- Attachment #2: Type: text/plain, Size: 148 bytes --]

_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard

^ permalink raw reply	[flat|nested] 1+ messages in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-12-06 17:41 Option to fwmark incoming packets? Matthias Urlichs

WireGuard Archive on lore.kernel.org

Archives are clonable: git clone --mirror https://lore.kernel.org/wireguard/0 wireguard/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 wireguard wireguard/ https://lore.kernel.org/wireguard \
		wireguard@lists.zx2c4.com zx2c4-wireguard@archiver.kernel.org
	public-inbox-index wireguard


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/com.zx2c4.lists.wireguard


AGPL code for this site: git clone https://public-inbox.org/ public-inbox