From 53e9a3296a41156c9fd6b52ff8dfdcbb54e5a023 Mon Sep 17 00:00:00 2001 From: Oldřich Jedlička Date: Thu, 15 Oct 2020 17:48:12 +0200 Subject: fwknop: Use sensible defaults. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Change KEY/HMAC_KEY to __CHANGEME__, which is rejected by fwknopd during start-up. The value CHANGEME is used only by LuCI package luci-app-fwknopd - pull request for generating keys directly from LuCI has been created already. * Add sensible defaults for ENABLE_IPT_FORWARDING and ENABLE_NAT_DNS, which both are/were set by luci-app-fwknopd. Move the defaults here. Signed-off-by: Oldřich Jedlička --- net/fwknop/files/fwknopd | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'net/fwknop/files') diff --git a/net/fwknop/files/fwknopd b/net/fwknop/files/fwknopd index e6db76b33..d830b10d9 100644 --- a/net/fwknop/files/fwknopd +++ b/net/fwknop/files/fwknopd @@ -8,10 +8,18 @@ config network config access option SOURCE 'ANY' - option HMAC_KEY 'CHANGEME' - option KEY 'CHANGEME' + option HMAC_KEY '__CHANGEME__' + option KEY '__CHANGEME__' config config # Alternative direct physical interface definition, but untracked - you # are on your own to correctly start/stop the service when needed # option PCAP_INTF 'eth0' + + # Allow SPA clients to request access to services through an iptables + # firewall instead of just to it (i.e. access through the FWKNOP_FORWARD + # chain instead of the INPUT chain + option ENABLE_IPT_FORWARDING 'Y' + + # Allow fwknopd to resolve hostnames in NAT access messages + option ENABLE_NAT_DNS 'Y' -- cgit v1.2.3