c4354871f7
- From now only a single OpenVPN connection is written to the OpenVPN configuration file - If multiple connections are matched given the user parameters (i.e. city, region), it is picked at pseudo random using the current time as the pseudo random seed. - Not relying on Openvpn picking a random remote address, may refer to #229 - Program is aware of which connection is to be used, in order to use its matching CN for port forwarding TLS verification with PIA v4 servers, see #236 - Simplified firewall mechanisms
40 lines
1.0 KiB
Go
40 lines
1.0 KiB
Go
package firewall
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/qdm12/gluetun/internal/models"
|
|
)
|
|
|
|
func (c *configurator) SetVPNConnection(ctx context.Context, connection models.OpenVPNConnection) (err error) {
|
|
c.stateMutex.Lock()
|
|
defer c.stateMutex.Unlock()
|
|
|
|
if !c.enabled {
|
|
c.logger.Info("firewall disabled, only updating internal VPN connection")
|
|
c.vpnConnection = connection
|
|
return nil
|
|
}
|
|
|
|
c.logger.Info("setting VPN connection through firewall...")
|
|
|
|
if c.vpnConnection.Equal(connection) {
|
|
return nil
|
|
}
|
|
|
|
remove := true
|
|
if c.vpnConnection.IP != nil {
|
|
if err := c.acceptOutputTrafficToVPN(ctx, c.defaultInterface, c.vpnConnection, remove); err != nil {
|
|
c.logger.Error("cannot remove outdated VPN connection through firewall: %s", err)
|
|
}
|
|
}
|
|
c.vpnConnection = models.OpenVPNConnection{}
|
|
remove = false
|
|
if err := c.acceptOutputTrafficToVPN(ctx, c.defaultInterface, connection, remove); err != nil {
|
|
return fmt.Errorf("cannot set VPN connection through firewall: %w", err)
|
|
}
|
|
c.vpnConnection = connection
|
|
return nil
|
|
}
|