mrash/fwknop — pull request #140 by DigitalDJ (2014-11-29 04:30:00+00:00)
Title: Add DESTINATION as a filter for stanzas as well as ENABLE_DESTINATION_RU...

...LE which will explicitly set the destination in the firewall rule

access.conf stanzas can now also include a DESTINATION, which will only activate that stanza if destination IP in the SPA packet IP header matches the set in the stanza list. This essentially works exactly the same way the SOURCE directive does (except that it does not dictate a new stanza).

In addition, ENABLE_DESTINATION_RULE controls whether fwknopd will set the destination field on the firewall rule to the destination address specified on the incoming SPA packet. This is useful for interfaces with multiple IP addresses hosting separate services. If ENABLE_IPT_OUTPUT is set to "Y", the source field of the firewall rule is set. FORWARD and SNAT rules are not affected however, DNAT rules will also have their destination field set. The default is "N", which sets the destination field to 0.0.0.0/0 (any).