From ed094bc68c7c702620864805dc462ff87eff8880 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan-Jonas=20S=C3=A4mann?= <sprinterfreak@binary-kitchen.de>
Date: Sun, 31 May 2020 10:57:58 +0200
Subject: [PATCH] gluon-core: firewall: Allow custom gluon_wired interfaces
(#2041)
This allows for multiple mesh legs out of one box. Useful for offloaders
and networks using vlan for separate mesh transport.
Custom mesh interfaces in a VXLAN domain are otherwise firewalled.
This fixes #1479
---
.../luasrc/lib/gluon/upgrade/140-firewall-rules | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules b/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
index ae374e331..e835e2f25 100755
--- a/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
+++ b/package/gluon-core/luasrc/lib/gluon/upgrade/140-firewall-rules
@@ -80,9 +80,18 @@ for _, zone in ipairs({ 'wan', 'local_client', 'mesh' }) do
end
--- We can't put mesh_wan into this zone, as mesh_wan is the same
--- interface as wan, which has its own zone
-uci:set('firewall', 'wired_mesh', 'network', {'mesh_lan'})
+local wired_mesh_ifaces = {}
+uci:foreach('network', 'interface',
+ function(iface)
+ -- Select all interfaces with proto gluon_wired except for
+ -- mesh_wan into this zone, as mesh_wan is the same
+ -- interface as wan, which has its own zone
+ if iface['proto'] == 'gluon_wired' and iface['.name'] ~= 'mesh_wan' then
+ table.insert(wired_mesh_ifaces, iface['.name'])
+ end
+ end
+)
+uci:set('firewall', 'wired_mesh', 'network', wired_mesh_ifaces)
-- VXLAN for wired meshing
for _, zone in ipairs({'wired_mesh', 'wan'}) do
--
GitLab