[git.ipfire.org] IPFire 2.x development tree branch, master, updated. baa22ec7a699eb8f5b73db54b9abfbf8580583ae

[Michael Tremer <git@ipfire.org>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, master has been updated
       via  baa22ec7a699eb8f5b73db54b9abfbf8580583ae (commit)
      from  60668b8297555e92d2df01fd47f3b96c18d3636d (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit baa22ec7a699eb8f5b73db54b9abfbf8580583ae
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Sun Jun 15 13:52:28 2025 +0100

    wireguard: Don't use fwmarks for the gateways
    
    This slightly conflicts with the reverse path filter which does not seem
    to consider the mark and therefore does not resolve to the correct route.
    
    There is not too much benefit of using the mark, except its elegance, a
    more accurate lookup and that we were hiding a direct route to the
    gateway from the clients.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 src/initscripts/system/wireguard | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

Difference in files:
diff --git a/src/initscripts/system/wireguard b/src/initscripts/system/wireguard
index 00862743b..caaa69cb9 100644
--- a/src/initscripts/system/wireguard
+++ b/src/initscripts/system/wireguard
@@ -27,9 +27,6 @@ shopt -s nullglob
 
 eval $(/usr/local/bin/readhash /var/ipfire/wireguard/settings)
 
-# Mark all packets coming out of the WireGuard interfaces
-WG_MARK="0x00800000"
-
 interfaces() {
 	local id
 	local enabled
@@ -223,7 +220,6 @@ generate_config() {
 		fi
 
 		echo "[Interface]"
-		echo "FwMark = ${WG_MARK}"
 
 		if [ -n "${privkey}" ]; then
 			echo "PrivateKey = ${privkey}"
@@ -324,7 +320,7 @@ reload_firewall() {
 
 	# Ensure that the table is being looked up
 	if ! ip rule | grep -q "lookup wg"; then
-		ip rule add table wg fwmark "${WG_MARK}"
+		ip rule add table wg
 	fi
 }
 


hooks/post-receive
--
IPFire 2.x development tree