1 files changed, 26 insertions, 0 deletions
diff --git a/roles/network/wireguard/gateway/templates/nftables.rules.j2 b/roles/network/wireguard/gateway/templates/nftables.rules.j2
new file mode 100644
index 00000000..fcf4a21b
--- /dev/null
+++ b/roles/network/wireguard/gateway/templates/nftables.rules.j2
@@ -0,0 +1,26 @@
+# {{ ansible_managed }}
+{% if 'ip_snat' in item.value %}
+
+table ip nat {
+  chain wireguard-gateway-{{ item.key }}-snat {
+    type nat hook postrouting priority 100; policy accept;
+    ip saddr { {{ item.value.addresses | map('ipaddr', 'network/prefix') | join(', ') }} } oifname {{ item.value.ip_snat.interface }} snat to {{ item.value.ip_snat.to }}
+  }
+}
+{% endif %}
+{% if 'port_forwardings' in item.value %}
+
+table ip nat {
+  chain wireguard-gateway-{{ item.key }}-port-forwardings {
+    type nat hook prerouting priority -100; policy accept;
+{%   for forward in item.value.port_forwardings %}
+{%     for port in forward.tcp_ports | default([]) %}
+    ip daddr {{ forward.dest }} tcp dport {{ port }} dnat to {{ forward.tcp_ports[port] }}
+{%     endfor %}
+{%     for port in forward.udp_ports | default([]) %}
+    ip daddr {{ forward.dest }} udp dport {{ port }} dnat to {{ forward.udp_ports[port] }}
+{%     endfor %}
+{%   endfor %}
+  }
+}
+{% endif %}