iptables

package
v0.78.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 3, 2026 License: BSD-3-Clause Imports: 23 Imported by: 1

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type InterfaceAllower added in v0.78.0 

type InterfaceAllower struct {
	// contains filtered or unexported fields
}

InterfaceAllower opens the NetBird interface on the iptables filter INPUT chain so the host firewall doesn't drop traffic the userspace firewall handles. It is the fallback used when nftables is unavailable (an iptables-legacy host).

It opens INPUT only: the userspace router never forwards in the kernel. firewalld trust is handled by the uspfilter manager, not here.

func NewInterfaceAllower added in v0.78.0 

func NewInterfaceAllower(wgIface iFaceMapper) (*InterfaceAllower, error)

NewInterfaceAllower builds an iptables allower for the interface. It returns an error when iptables is unavailable, so the caller can fall back to firewalld trust.

func (*InterfaceAllower) Apply added in v0.78.0 

func (a *InterfaceAllower) Apply() error

Apply inserts the interface accept rule on the filter INPUT chain. It removes any stale rule first so an unclean exit (e.g. SIGKILL, where Close never ran) is recovered deterministically rather than accumulating duplicates.

func (*InterfaceAllower) Close added in v0.78.0 

func (a *InterfaceAllower) Close() error

Close removes the interface accept rule.

type InterfaceState added in v0.30.3 

type InterfaceState struct {
	NameStr   string         `json:"name"`
	WGAddress wgaddr.Address `json:"wg_address"`
	MTU       uint16         `json:"mtu"`
}

func (*InterfaceState) Address added in v0.30.3 

func (i *InterfaceState) Address() wgaddr.Address

func (*InterfaceState) Name added in v0.30.3 

func (i *InterfaceState) Name() string

type Manager 

type Manager struct {
	// contains filtered or unexported fields
}

Manager of iptables firewall. Per-family state (peer ACLs, route ACLs, NAT, DNAT, MSS clamping) lives on family; Manager dispatches by family and provides the public firewall.Manager surface.

func Create 

func Create(wgIface iFaceMapper, mtu uint16) (*Manager, error)

Create iptables firewall manager

func (*Manager) AddDNATRule added in v0.38.0 

func (m *Manager) AddDNATRule(rule firewall.ForwardRule) (firewall.Rule, error)

AddDNATRule adds a DNAT rule

func (*Manager) AddFilterRule added in v0.78.0 

func (m *Manager) AddFilterRule(
	id []byte,
	sources []netip.Prefix,
	destination firewall.Network,
	proto firewall.Protocol,
	sPort *firewall.Port,
	dPort *firewall.Port,
	action firewall.Action,
) (firewall.Rule, error)

AddFilterRule installs a packet-filtering rule. See firewall.Manager docs for destination semantics. Sources are a single address family; the rule is dispatched to the matching v4 / v6 backend.

func (*Manager) AddInboundDNAT added in v0.59.9 

func (m *Manager) AddInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error

AddInboundDNAT adds an inbound DNAT rule redirecting traffic from NetBird peers to local services.

func (*Manager) AddNatRule added in v0.30.0 

func (m *Manager) AddNatRule(pair firewall.RouterPair) error

func (*Manager) AddOutputDNAT added in v0.68.0 

func (m *Manager) AddOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error

AddOutputDNAT adds an OUTPUT chain DNAT rule for locally-generated traffic.

func (*Manager) Close added in v0.37.2 

func (m *Manager) Close(stateManager *statemanager.Manager) error

Reset firewall to the default state

func (*Manager) DeleteDNATRule added in v0.38.0 

func (m *Manager) DeleteDNATRule(rule firewall.Rule) error

DeleteDNATRule deletes a DNAT rule

func (*Manager) DeleteFilterRule added in v0.78.0 

func (m *Manager) DeleteFilterRule(rule firewall.Rule) error

DeleteFilterRule removes a rule previously added via AddFilterRule. The rule is looked up by id in each family's filter cache.

func (*Manager) DisableRouting added in v0.36.6 

func (m *Manager) DisableRouting() error

func (*Manager) EnableRouting added in v0.36.6 

func (m *Manager) EnableRouting() error

func (*Manager) Flush added in v0.21.9 

func (m *Manager) Flush() error

Flush doesn't need to be implemented for this manager

func (*Manager) Init added in v0.30.3 

func (m *Manager) Init(stateManager *statemanager.Manager) error

func (*Manager) IsServerRouteSupported added in v0.24.4 

func (m *Manager) IsServerRouteSupported() bool

func (*Manager) IsStateful added in v0.46.0 

func (m *Manager) IsStateful() bool

func (*Manager) RemoveInboundDNAT added in v0.59.9 

func (m *Manager) RemoveInboundDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error

RemoveInboundDNAT removes an inbound DNAT rule.

func (*Manager) RemoveNatRule added in v0.30.0 

func (m *Manager) RemoveNatRule(pair firewall.RouterPair) error

func (*Manager) RemoveOutputDNAT added in v0.68.0 

func (m *Manager) RemoveOutputDNAT(localAddr netip.Addr, protocol firewall.Protocol, originalPort, translatedPort uint16) error

RemoveOutputDNAT removes an OUTPUT chain DNAT rule.

func (*Manager) SetLegacyManagement added in v0.30.0 

func (m *Manager) SetLegacyManagement(isLegacy bool) error

func (*Manager) SetLogLevel added in v0.36.6 

func (m *Manager) SetLogLevel(log.Level)

SetLogLevel sets the log level for the firewall manager

func (*Manager) SetupEBPFProxyNoTrack added in v0.64.2 

func (m *Manager) SetupEBPFProxyNoTrack(proxyPort, wgPort uint16) error

SetupEBPFProxyNoTrack creates notrack rules for eBPF proxy loopback traffic. This prevents conntrack from tracking WireGuard proxy traffic on loopback, which can interfere with MASQUERADE rules (e.g., from container runtimes like Podman/netavark).

Traffic flows that need NOTRACK:

  1. Egress: WireGuard -> fake endpoint (before eBPF rewrite) src=127.0.0.1:wgPort -> dst=127.0.0.1:fakePort Matched by: sport=wgPort

  2. Egress: Proxy -> WireGuard (via raw socket) src=127.0.0.1:fakePort -> dst=127.0.0.1:wgPort Matched by: dport=wgPort

  3. Ingress: Packets to WireGuard dst=127.0.0.1:wgPort Matched by: dport=wgPort

  4. Ingress: Packets to proxy (after eBPF rewrite) dst=127.0.0.1:proxyPort Matched by: dport=proxyPort

Rules are cleaned up when the firewall manager is closed.

func (*Manager) UpdateSet added in v0.43.0 

func (m *Manager) UpdateSet(set firewall.Set, prefixes []netip.Prefix) error

UpdateSet updates the set with the given prefixes

type Rule 

type Rule struct {
	// contains filtered or unexported fields
}

Rule to handle management of rules. Source set membership (when the rule was built against a shared hash:net ipset) is encoded in specs; DeleteFilterRule recovers it via findSets so the refcounter can drop the right reference.

func (*Rule) ID added in v0.38.0 

func (r *Rule) ID() manager.RuleID

ID returns the rule id

type ShutdownState added in v0.30.3 

type ShutdownState struct {
	sync.Mutex

	InterfaceState *InterfaceState `json:"interface_state,omitempty"`

	RouteRules         routeRules    `json:"route_rules,omitempty"`
	RouteRules6        routeRules    `json:"route_rules_v6,omitempty"`
	RouteIPsetCounter  *ipsetCounter `json:"route_ipset_counter,omitempty"`
	RouteIPsetCounter6 *ipsetCounter `json:"route_ipset_counter_v6,omitempty"`

	ACLEntries  aclEntries `json:"acl_entries,omitempty"`
	ACLEntries6 aclEntries `json:"acl_entries_v6,omitempty"`
}

func (*ShutdownState) Cleanup added in v0.30.3 

func (s *ShutdownState) Cleanup() error

func (*ShutdownState) Name added in v0.30.3 

func (s *ShutdownState) Name() string

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.