Signed-off-by: Sotir Danailov <[email protected]>
---
src/man/wg-quick.8 | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/src/man/wg-quick.8 b/src/man/wg-quick.8
index b84eb64..9f8414e 100644
--- a/src/man/wg-quick.8
+++ b/src/man/wg-quick.8
@@ -156,6 +156,13 @@ two lines `PostUp` and `PreDown` lines to the
`[Interface]` section:
\fBPreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i
fwmark) -m addrtype ! --dst-type LOCAL -j REJECT\fP
.br
+When using `firewalld', the ``kill-switch'' can be done like so:
+
+ \fBPostUp = firewall-cmd --permanent --direct --add-rule ipv4 filter
OUTPUT 0 ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type
LOCAL -j REJECT && firewall-cmd --reload\fP
+.br
+ \fBPreDown = firewall-cmd --permanent --direct --remove-rule ipv4 filter
OUTPUT 0 ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type
LOCAL -j REJECT && firewall-cmd --reload\fP
+.br
+
The `PostUp' and `PreDown' fields have been added to specify an
.BR iptables (8)
command which, when used with interfaces that have a peer that specifies
0.0.0.0/0 as part of the
--
2.37.1
