roles/network/wireguard/gateway/templates/nftables.rules.j2


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

# {{ ansible_managed }}
{% if 'ip_snat' in item.value %}

table ip nat {
  chain wireguard-gateway-{{ item.key }}-snat {
    type nat hook postrouting priority 100; policy accept;
    ip saddr { {{ item.value.addresses | map('ipaddr', 'network/prefix') | join(', ') }} } oifname {{ item.value.ip_snat.interface }} snat to {{ item.value.ip_snat.to }}
  }
}
{% endif %}
{% if 'port_forwardings' in item.value %}

table ip nat {
  chain wireguard-gateway-{{ item.key }}-port-forwardings {
    type nat hook prerouting priority -100; policy accept;
{%   for forward in item.value.port_forwardings %}
{%     for port in forward.tcp_ports | default([]) %}
    ip daddr {{ forward.dest }} tcp dport {{ port }} dnat to {{ forward.tcp_ports[port] }}
{%     endfor %}
{%     for port in forward.udp_ports | default([]) %}
    ip daddr {{ forward.dest }} udp dport {{ port }} dnat to {{ forward.udp_ports[port] }}
{%     endfor %}
{%   endfor %}
  }
}
{% endif %}