fff-firewall: add user-customizable nftables hook #317

fbl · 2024-03-11T22:11:45+01:00

fbl commented

2024-03-11 22:11:45 +01:00

Currently there is no way to persistently configure firewall rules on a
router. This might be desirable as home-use of the Freifunk network is
quite common these days.

To allow for the most flexibility while keeping maintenance efforts low,
add a persistent, user-customizable nftables hook. It is evaluated after
all firewall rules have already been configured, so it is possible to
override them.

Users of this hook are responsible for keeping up with changes to the
firmware and modify it appropriately, before updating the system.

Fixes: #314

While at it, merge sysupgrade.conf entires into a single uci-defaults script.

Currently there is no way to persistently configure firewall rules on a router. This might be desirable as home-use of the Freifunk network is quite common these days. To allow for the most flexibility while keeping maintenance efforts low, add a persistent, user-customizable nftables hook. It is evaluated after all firewall rules have already been configured, so it is possible to override them. Users of this hook are responsible for keeping up with changes to the firmware and modify it appropriately, before updating the system. Fixes: #314 While at it, merge sysupgrade.conf entires into a single uci-defaults script.

fbl added the

feature

label 2024-03-11 22:11:45 +01:00

fbl added 2 commits 2024-03-11 22:11:45 +01:00

1309eaaf11 fff-firewall: add user-customizable nftables hook

Currently there is no way to persistently configure firewall rules on a
router. This might be desirable as home-use of the Freifunk network is
quite common these days.

To allow for the most flexibility while keeping maintenance efforts low,
add a persistent, user-customizable nftables hook. It is evaluated after
all firewall rules have already been configured, so it is possible to
override them.

Users of this hook are responsible for keeping up with changes to the
firmware and modify it appropriately, before updating the system.

Fixes: #314

Signed-off-by: Fabian Bläse <fabian@blaese.de>

ci/woodpecker/pull_request_closed/woodpecker Pipeline is pending Details

871e80eb35 Consolidate sysupgrade.conf entries

Most of the entries in /etc/sysupgrade.conf are generated by a
uci-defaults script in the fff-sysupgrade package. The only entry
added in a different place is rc.local.fff_userconfig.

Consolidate all entries to be added by the uci-defaults script in
fff-sysupgrade.

Signed-off-by: Fabian Bläse <fabian@blaese.de>

fbl commented

2024-04-01 23:53:44 +02:00

Applied.

fbl closed this pull request

2024-04-01 23:53:44 +02:00

fbl added this to the 20240401-beta milestone 2024-04-01 23:53:47 +02:00

ci/woodpecker/pull_request_closed/woodpecker Pipeline is pending

Details