mrash/fwknop — pull request #141 by DigitalDJ (2014-11-29 04:36:47+00:00)
Title: Add DESTINATION access.conf directive and ENABLE_DESTINATION_RULE fwknop...

...d.conf directive

access.conf stanzas can now also include a DESTINATION, which will only activate that stanza if destination IP in the SPA packet IP header matches the set in the stanza list. This essentially works exactly the same way the SOURCE directive does (except that it does not dictate a new stanza).

In addition, ENABLE_DESTINATION_RULE controls whether fwknopd will set the destination field on the firewall rule to the destination address specified on the incoming SPA packet. This is useful for interfaces with multiple IP addresses hosting separate services. If ENABLE_IPT_OUTPUT is set to "Y", the source field of the firewall rule is set. FORWARD and SNAT rules are not affected however, DNAT rules will also have their destination field set. The default is "N", which sets the destination field to 0.0.0.0/0 (any).

Sorry for the additional pull request, didn't pull before merging.