scripte/wireguard-ui-multi
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix nftables auto-merge syntax and block private/reserved ranges

Browse Source 
auto-merge is a standalone set statement, not an nft "flags" value -
"flags interval, auto-merge;" is a syntax error; fixed to "flags
interval;" followed by "auto-merge" on its own line. Needed because large
public blocklists (FireHOL, Spamhaus) contain overlapping CIDRs that
nftables otherwise refuses as "conflicting intervals".

Also add a hard guard: reject any "block" entry that overlaps a private/
reserved/bogon range (RFC1918, CGNAT, loopback, link-local, etc.) in both
the single-entry and bulk-import paths. Public feeds like FireHOL level1
routinely include ranges like 10.0.0.0/8 and 172.16.0.0/12, meant for
WAN-only edge firewalls - applied host-wide here (where WireGuard/LAN
subnets legitimately live in that same private space), those entries
would silently block a server's own internal/VPN traffic instead of
actual bad actors.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
sysops
2026-07-12 20:44:29 +02:00
co-authored by Claude Sonnet 5
parent a9649f6306
commit 00d084a188
2 changed files with 52 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
firewall/global.go
+2 -2
View File
@@ -33,13 +33,13 @@ func GenerateGlobalRuleset(entries []model.IPListEntry) string {
fmt.Fprintf(&b, "table inet %s {\n", GlobalTableName)
fmt.Fprintf(&b, " set allowlist {\n type ipv4_addr; flags interval;\n")
fmt.Fprintf(&b, " set allowlist {\n type ipv4_addr; flags interval;\n auto-merge\n")
if len(allow) > 0 {
fmt.Fprintf(&b, " elements = { %s }\n", strings.Join(allow, ", "))
}
fmt.Fprintf(&b, " }\n\n")
fmt.Fprintf(&b, " set blocklist {\n type ipv4_addr; flags interval;\n")
fmt.Fprintf(&b, " set blocklist {\n type ipv4_addr; flags interval;\n auto-merge\n")
if len(block) > 0 {
fmt.Fprintf(&b, " elements = { %s }\n", strings.Join(block, ", "))
}