36 lines
1.5 KiB
Plaintext
36 lines
1.5 KiB
Plaintext
chain vpn_prerouting_dnat {
|
|
type nat hook prerouting priority dstnat - 5; policy accept;
|
|
|
|
iifname wg0 ip daddr 10.250.251.0/24 counter dnat ip prefix to 10.1.0.0/24
|
|
iifname wg0 ip daddr 10.250.252.0/24 counter dnat ip prefix to 10.2.0.0/24
|
|
iifname wg0 ip daddr 10.250.253.0/24 counter dnat ip prefix to 10.10.0.0/24
|
|
iifname wg0 ip daddr 10.250.254.0/24 counter dnat ip prefix to 10.11.0.0/24
|
|
iifname wg0 ip daddr 10.250.255.0/24 counter dnat ip prefix to 10.12.0.0/24
|
|
iifname wg0 ip daddr 10.250.249.0/24 counter dnat ip prefix to 10.13.0.0/24
|
|
}
|
|
|
|
chain vpn_postrouting_snat {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
|
|
oifname wg0 ip saddr 10.1.0.0/24 counter snat ip prefix to 10.250.251.0/24
|
|
oifname wg0 ip saddr 10.2.0.0/24 counter snat ip prefix to 10.250.252.0/24
|
|
oifname wg0 ip saddr 10.10.0.0/24 counter snat ip prefix to 10.250.253.0/24
|
|
oifname wg0 ip saddr 10.11.0.0/24 counter snat ip prefix to 10.250.254.0/24
|
|
oifname wg0 ip saddr 10.12.0.0/24 counter snat ip prefix to 10.250.255.0/24
|
|
oifname wg0 ip saddr 10.13.0.0/24 counter snat ip prefix to 10.250.249.0/24
|
|
}
|
|
|
|
chain vpn_prerouting_pbr {
|
|
type filter hook prerouting priority mangle - 10; policy accept;
|
|
|
|
iifname wg0 ct state new counter ct mark set 0x000000c7
|
|
ip daddr 10.0.0.0/8 return
|
|
iifname != "wg0" ct mark 0x000000c7 counter mark set 0x000000c7
|
|
}
|
|
|
|
chain vpn_output_pbr {
|
|
type route hook output priority mangle - 10; policy accept;
|
|
|
|
ct mark 0x000000c7 counter meta mark set 0x000000c7
|
|
}
|