vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-11-03 04:12:03 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #588 from usman-umer/equuleus

Browse Source 
Added instructions for firewall exception for equuleus branch
This commit is contained in:
Robert Göhler 2021-08-03 21:06:07 +02:00 committed by GitHub
commit 073fada067
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
docs/configuration/interfaces/openvpn.rst
View File

@ -130,6 +130,33 @@ Remote Configuration - Annotated:
set interfaces openvpn vtun1 local-address '10.255.1.2' # Local IP of vtun interface set interfaces openvpn vtun1 local-address '10.255.1.2' # Local IP of vtun interface
set interfaces openvpn vtun1 remote-address '10.255.1.1' # Remote IP of vtun interface set interfaces openvpn vtun1 remote-address '10.255.1.1' # Remote IP of vtun interface
*******************
Firewall Exceptions
*******************
For the OpenVPN traffic to pass through the WAN interface, you must create a
firewall exception.
.. code-block:: none
set firewall name OUTSIDE_LOCAL rule 10 action accept
set firewall name OUTSIDE_LOCAL rule 10 description 'Allow established/related'
set firewall name OUTSIDE_LOCAL rule 10 state established enable
set firewall name OUTSIDE_LOCAL rule 10 state related enable
set firewall name OUTSIDE_LOCAL rule 20 action accept
set firewall name OUTSIDE_LOCAL rule 20 description OpenVPN_IN
set firewall name OUTSIDE_LOCAL rule 20 destination port 1195
set firewall name OUTSIDE_LOCAL rule 20 log enable
set firewall name OUTSIDE_LOCAL rule 20 protocol udp
set firewall name OUTSIDE_LOCAL rule 20 source
You should also ensure that the OUTISDE_LOCAL firewall group is applied to the
WAN interface and a direction (local).
.. code-block:: none
set interfaces ethernet eth0 firewall local name 'OUTSIDE-LOCAL'
Static Routing: Static Routing:
Static routes can be configured referencing the tunnel interface; for example, Static routes can be configured referencing the tunnel interface; for example,