mirror of
https://github.com/outbackdingo/firezone.git
synced 2026-01-27 18:18:55 +00:00
79a24ca9cf
Previously, we required the user to specify a `LISTEN_IP4_ADDR` and/or a `LISTEN_IP6_ADDR` parameter. This is cumbersome because dynamically fetching the address of the local interface is not trivial in all environments. We remove this parameter in exchange for listening on all interfaces. This is a trade-off. The relay will now listen on all interfaces, even the ones not exposed to the public internet. This is true for the main socket on port 3478 and for all created allocations. Actually relaying data relies on the 4-tuple of a "connection", i.e. the source and destination address and port. Technically, I think it is possible with this change to send traffic to a relay via an interface that was not intended to be used for that. I think this will still require spoofing the source address which is a known and accepted problem. It is still recommended that operators put appropriate firewall rules in place to not allow ingress traffic on any interface other than the one intended for relaying. I've tested locally that we are correctly using the `IPV6_ONLY` flag. In other words, a relay listening on the `0.0.0.0` wildcard interface will not accept IPv6 traffic and vice versa. Resolves #1886.
28 lines
923 B
Bash
Executable File
28 lines
923 B
Bash
Executable File
#!/bin/bash
|
|
|
|
if [[ "${ENABLE_MASQUERADE}" == "1" ]]; then
|
|
IFACE="utun"
|
|
iptables -A FORWARD -i $IFACE -j ACCEPT
|
|
iptables -A FORWARD -o $IFACE -j ACCEPT
|
|
iptables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
|
|
ip6tables -A FORWARD -i $IFACE -j ACCEPT
|
|
ip6tables -A FORWARD -o $IFACE -j ACCEPT
|
|
ip6tables -t nat -A POSTROUTING -o eth+ -j MASQUERADE
|
|
fi
|
|
|
|
if [[ "${LISTEN_ADDRESS_DISCOVERY_METHOD}" == "gce_metadata" ]]; then
|
|
echo "Using GCE metadata to discover listen address"
|
|
|
|
if [[ "${PUBLIC_IP4_ADDR:-}" == "" ]]; then
|
|
export PUBLIC_IP4_ADDR=$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google" -s)
|
|
echo "Discovered PUBLIC_IP4_ADDR: ${PUBLIC_IP4_ADDR}"
|
|
fi;
|
|
fi
|
|
|
|
# if first arg looks like a flag, assume we want to run postgres server
|
|
if [ "${1:0:1}" = '-' ]; then
|
|
set -- ${PACKAGE_NAME} "$@"
|
|
fi
|
|
|
|
exec "$@"
|