fw

Documentation

Index

• func Apply(cfg Config) error
• func ApplyRules(iptablesRules rules.RuleSet) error
• func BlockInputFromInterface(proto string, iface Link) rules.Rule
• func Forward(in, out Link) rules.Rule
• func ForwardToSubnet(in, out Link, dst Addr) rules.Rule
• func Masquerade(out Link) rules.Rule
• func OpenPort(proto string, port int) rules.Rule
• func OpenPortOnInterface(proto string, port int, iface Link) rules.Rule
• type Addr
  • func ParseAddr(s string) (a Addr, err error)
  • func (a Addr) String() string
• type Config
  • func WithExtraRules(cfg Config, extraRules []rules.Rule) Config
• type Link
• type LinkString
  • func (l LinkString) Name() string
• type StaticRoute

Functions

func Apply

func Apply(cfg Config) error

Creates a RuleSet from cfg and applies it.

func ApplyRules

func ApplyRules(iptablesRules rules.RuleSet) error

Applies a set of iptables rules in order.

func BlockInputFromInterface

func BlockInputFromInterface(proto string, iface Link) rules.Rule

Blocks input (local connections) from a specific network interface. This is specific to L4/transport-layer (TCP/UDP currently, other protos may be added in the future) assuming things like ICMP shouldn't be blocked.

func Forward

func Forward(in, out Link) rules.Rule

Allows traffic to be forwarded from in to out. Note that this doesn't affect the routing rules at all.

func ForwardToSubnet

func ForwardToSubnet(in, out Link, dst Addr) rules.Rule

Allows traffic to be forwarded from in to out when directed to a specific subnet. Note that this doesn't affect the routing rules at all.

func Masquerade

func Masquerade(out Link) rules.Rule

Masquerades traffic forwarded to out.

func OpenPort

func OpenPort(proto string, port int) rules.Rule

Allows either tcp or udp input traffic to a specific port.

func OpenPortOnInterface

func OpenPortOnInterface(proto string, port int, iface Link) rules.Rule

Allows either tcp or udp input traffic to a specific port from a specific interface.

Types

type Addr

type Addr struct {
	IP   net.IP
	Mask net.IPMask
}

An IP address and CIDR mask.

func ParseAddr

func ParseAddr(s string) (a Addr, err error)

func (Addr) String

func (a Addr) String() string

type Config

type Config interface {
	// Link connected to the network with local clients.
	LAN() Link

	// Link connected to a broader network (possibly the internet) that will
	// be used to masquerade outbound connections from LAN().
	Uplink() Link

	// Other networks that can be routed to from LAN without masquerading. The
	// static route will not be established in the reverse direction.
	FlatNetworks() []StaticRoute

	ExtraRules() rules.RuleSet
}

func WithExtraRules

func WithExtraRules(cfg Config, extraRules []rules.Rule) Config

Appends extra rules to the extra rules already present on cfg.

type Link

type Link interface {
	Name() string
}

A connected network interface.

type LinkString

type LinkString string

func (LinkString) Name

func (l LinkString) Name() string

type StaticRoute

type StaticRoute struct {
	Link   Link
	Subnet Addr
}

Union of a subnet specified in CIDR and the Link it can be reached on.