mirror of
https://github.com/netbirdio/netbird.git
synced 2026-04-16 15:26:40 +00:00
246abda46d
Add a default firewall rule to allow netbird traffic to be handled by the access control managers. Userspace manager behavior: - When running on Windows, a default rule is add on Windows firewall - For Linux, we are using one of the Kernel managers to add a single rule - This PR doesn't handle macOS Kernel manager behavior: - For NFtables, if there is a filter table, an INPUT rule is added - Iptables follows the previous flow if running on kernel mode. If running on userspace mode, it adds a single rule for INPUT and OUTPUT chains A new checkerFW package has been introduced to consolidate checks across route and access control managers. It supports a new environment variable to skip nftables and allow iptables tests
29 lines
655 B
Go
29 lines
655 B
Go
//go:build !linux
|
|
|
|
package acl
|
|
|
|
import (
|
|
"fmt"
|
|
"runtime"
|
|
|
|
log "github.com/sirupsen/logrus"
|
|
|
|
"github.com/netbirdio/netbird/client/firewall/uspfilter"
|
|
)
|
|
|
|
// Create creates a firewall manager instance
|
|
func Create(iface IFaceMapper) (manager *DefaultManager, err error) {
|
|
if iface.IsUserspaceBind() {
|
|
// use userspace packet filtering firewall
|
|
fm, err := uspfilter.Create(iface)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := fm.AllowNetbird(); err != nil {
|
|
log.Errorf("failed to allow netbird interface traffic: %v", err)
|
|
}
|
|
return newDefaultManager(fm), nil
|
|
}
|
|
return nil, fmt.Errorf("not implemented for this OS: %s", runtime.GOOS)
|
|
}
|