Skip to content

feat: Add firewall support to prevent local network access - #6

Open
tolbrino wants to merge 12 commits into
mainfrom
tb/202610-firewall
Open

tolbrino wants to merge 12 commits into
mainfrom
tb/202610-firewall

Conversation

@tolbrino

Copy link
Copy Markdown
Collaborator

Also:

  • blocklist support
  • user traffic shaping

@tolbrino tolbrino self-assigned this Oct 28, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to start thinking about not duplicating code. This same code is in gnosis_vpn-infrastructure and it should be part of the gnosis_vpn-server repository artifacts.
And each deployment model (gnosis_vpn-infrastructure, dappNode, exitOS should download it via a package or similar.

I think it's time to create an issue to handle this

@tolbrino tolbrino Oct 28, 2026 •

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree, too many duplications.

Comment thread README.md
`wg-quick` runs the script from `PostUp`/`PreDown` in `wggvpn.conf`. It is a port of the
`wg-hooks.sh` + `iptables.rules` pair from the exit-node appliance image (`gnosis_vpn-exit_os`).
The appliance version can't be used as-is, because a DAppNode package never sees the host's
network namespace (see "Known limitations" below).

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on my previous comment, I still think that there are too many similarities that it's worth to join both efforts into one place and make it configurable.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants