diff options
Diffstat (limited to 'src')
| -rwxr-xr-x | src/conf_mode/interfaces_wireguard.py | 5 | ||||
| -rwxr-xr-x | src/conf_mode/vrf.py | 5 |
2 files changed, 6 insertions, 4 deletions
diff --git a/src/conf_mode/interfaces_wireguard.py b/src/conf_mode/interfaces_wireguard.py index 92e3a239d..4cb544b72 100755 --- a/src/conf_mode/interfaces_wireguard.py +++ b/src/conf_mode/interfaces_wireguard.py @@ -31,6 +31,7 @@ from vyos.configverify import verify_bridge_delete from vyos.configverify import verify_mtu_ipv6 from vyos.configverify import verify_mirror_redirect from vyos.configverify import verify_bond_bridge_member +from vyos.defaults import wireguard_fwmark_pref from vyos.ifconfig import WireGuardIf from vyos.utils.kernel import check_kmod from vyos.utils.network import check_port_availability @@ -174,7 +175,7 @@ def apply(wireguard): if table_id is not None: for afi in ['-4', '-6']: call( - f'ip {afi} rule del pref 1998 fwmark {prev_fwmark} table {table_id}' + f'ip {afi} rule del pref {wireguard_fwmark_pref} fwmark {prev_fwmark} table {table_id}' ) # Add ip rule to route fwmark-marked WireGuard tunnel packets into the @@ -185,7 +186,7 @@ def apply(wireguard): table_id = get_vrf_tableid(wireguard['vrf']) for afi in ['-4', '-6']: call( - f'ip {afi} rule add pref 1998 fwmark {wireguard["fwmark"]} table {table_id}' + f'ip {afi} rule add pref {wireguard_fwmark_pref} fwmark {wireguard["fwmark"]} table {table_id}' ) domain_resolver_usage = '/run/use-vyos-domain-resolver-interfaces-wireguard-' + wireguard['ifname'] diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py index c307ae27e..405032ad5 100755 --- a/src/conf_mode/vrf.py +++ b/src/conf_mode/vrf.py @@ -23,6 +23,7 @@ import vyos.defaults from vyos.config import Config from vyos.configdict import node_changed from vyos.configverify import verify_route_map +from vyos.defaults import wireguard_fwmark_pref from vyos.firewall import conntrack_required from vyos.frrender import FRRender from vyos.frrender import get_frrender_dict @@ -265,10 +266,10 @@ def apply(vrf): # Remove map element cmd(f'nft {nft_del_element}') - # Remove all ip rules pointing to this VRF table + # Remove WireGuard fwmark routing rules created for this VRF table table_id = get_vrf_tableid(tmp) for afi in ['-4', '-6']: - while call(f'ip {afi} rule del table {table_id}') == 0: + while call(f'ip {afi} rule del pref {wireguard_fwmark_pref} table {table_id}') == 0: pass # Delete the VRF Kernel interface |