From 72e99501a1f8599909c8d295274d56d2d86e19bc Mon Sep 17 00:00:00 2001 From: Haitao Pan Date: Mon, 7 Apr 2025 20:09:57 +0800 Subject: [PATCH] chore(config): update firewall and VPN overlay settings - allow UDP 51820 for WireGuard - remove 10.253.0.0/16 from allowed IPs in WireGuard site configs --- config/sit/firewall.yaml | 4 ++++ config/sit/vpn-overlay.yaml | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/config/sit/firewall.yaml b/config/sit/firewall.yaml index 0d7c58b7..697e429c 100644 --- a/config/sit/firewall.yaml +++ b/config/sit/firewall.yaml @@ -19,6 +19,8 @@ firewall_rules: ports: ["22"] - protocol: udp ports: ["4789"] + - protocol: udp + ports: ["51820"] - name: dev-vpc-2-default-inbound enabled: true @@ -31,3 +33,5 @@ firewall_rules: ports: ["22"] - protocol: udp ports: ["4789"] + - protocol: udp + ports: ["51820"] diff --git a/config/sit/vpn-overlay.yaml b/config/sit/vpn-overlay.yaml index dbcd4912..c78c8fa9 100644 --- a/config/sit/vpn-overlay.yaml +++ b/config/sit/vpn-overlay.yaml @@ -28,7 +28,7 @@ hubs: sites: - name: master-1 interface: ens5 - allowed_ips: "172.16.0.0/16,10.253.0.0/16" + allowed_ips: "172.16.0.0/16" wireguard_peer: hub-1 br_ip: 10.253.253.2 wg_ip: 172.16.0.10 @@ -44,7 +44,7 @@ sites: - name: slave-1 interface: ens5 wireguard_peer: hub-1 - allowed_ips: "172.16.0.0/16,10.253.0.0/16" + allowed_ips: "172.16.0.0/16" br_ip: 10.253.253.3 wg_ip: 172.16.0.11 local_ip: 172.16.0.11