[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 8e1a9a3699e7061405ae7ee49caf672558a1c792

[Michael Tremer <git@ipfire.org>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  8e1a9a3699e7061405ae7ee49caf672558a1c792 (commit)
      from  09fc0f7d298f6a68d37809f17696e2609de9f2fc (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 8e1a9a3699e7061405ae7ee49caf672558a1c792
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Sun Jun 15 13:52:28 2025 +0100

    wireguard: Don't use fwmarks for the gateways
    
    This slightly conflicts with the reverse path filter which does not seem
    to consider the mark and therefore does not resolve to the correct route.
    
    There is not too much benefit of using the mark, except its elegance, a
    more accurate lookup and that we were hiding a direct route to the
    gateway from the clients.
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 src/initscripts/system/wireguard | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

Difference in files:
diff --git a/src/initscripts/system/wireguard b/src/initscripts/system/wireguard
index 00862743b..caaa69cb9 100644
--- a/src/initscripts/system/wireguard
+++ b/src/initscripts/system/wireguard
@@ -27,9 +27,6 @@ shopt -s nullglob
 
 eval $(/usr/local/bin/readhash /var/ipfire/wireguard/settings)
 
-# Mark all packets coming out of the WireGuard interfaces
-WG_MARK="0x00800000"
-
 interfaces() {
 	local id
 	local enabled
@@ -223,7 +220,6 @@ generate_config() {
 		fi
 
 		echo "[Interface]"
-		echo "FwMark = ${WG_MARK}"
 
 		if [ -n "${privkey}" ]; then
 			echo "PrivateKey = ${privkey}"
@@ -324,7 +320,7 @@ reload_firewall() {
 
 	# Ensure that the table is being looked up
 	if ! ip rule | grep -q "lookup wg"; then
-		ip rule add table wg fwmark "${WG_MARK}"
+		ip rule add table wg
 	fi
 }
 


hooks/post-receive
--
IPFire 2.x development tree