whalewall

whalewall copied to clipboard

Currently only TCP/UDP can be specified in firewall rules. Would it be possible to extend this to include ICMP as a protocol that can be configured?

It's definitely possible, the config format would likely have to be updated as I'm sure you'd want the ability to specify what ICMP messages would be allowed or denied right?

~~Does the current configuration block all ICMP by default?~~

*Edit I just tested this and indeed all ICMP is blocked, is there at least a way to allow it by default?

I tried adding - proto: icmp but that resulted in a mild explosion:

{"level":"error","time":"2023-08-21T09:03:40.977906129Z","msg":"error creating rules","container.id":"bfc355a8cc43","container.name":"borgmatic","error":"error parsing rules: invalid protocol \"icmp\"","stacktrace":"github.com/capnspacehook/whalewall.(*RuleManager).createRules\n\tgithub.com/capnspacehook/whalewall/create.go:63\ngithub.com/capnspacehook/whalewall.(*RuleManager).Start.func1\n\tgithub.com/capnspacehook/whalewall/manager.go:118"}