Skip to content

Commit e6b7fce

Browse files
moubctezmoubctez
authored
OPNsense plugin for Gateway 2.0 (#290)
1 parent dd020b5 commit e6b7fce

10 files changed

Lines changed: 188 additions & 86 deletions

File tree

‎Cargo.lock‎

Lines changed: 22 additions & 17 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ edition = "2024"
77
axum = "0.8"
88
base64 = "0.22"
99
chrono = "0.4"
10-
clap = { version = "4.5", features = ["derive", "env"] }
11-
defguard_certs = { git = "https://github.com/DefGuard/defguard.git", rev = "9c6cbd5108470f9c8dc9b4ee740a9a08f071468c" }
12-
defguard_version = { git = "https://github.com/DefGuard/defguard.git", rev = "9c6cbd5108470f9c8dc9b4ee740a9a08f071468c" }
10+
clap = { version = "4.6", features = ["derive", "env"] }
11+
defguard_certs = { git = "https://github.com/DefGuard/defguard.git", rev = "b6921e0f510eae1114844c3df5f5a74c23a75e46" }
12+
defguard_version = { git = "https://github.com/DefGuard/defguard.git", rev = "b6921e0f510eae1114844c3df5f5a74c23a75e46" }
1313
defguard_wireguard_rs = "0.9"
1414
env_logger = "0.11"
1515
gethostname = "1.0"
@@ -56,7 +56,7 @@ x25519-dalek = { version = "2.0", features = ["getrandom", "static_secrets"] }
5656

5757
[build-dependencies]
5858
tonic-prost-build = "0.14"
59-
vergen-git2 = { version = "9.1", features = ["build"] }
59+
vergen-git2 = "9.1"
6060

6161
[profile.release]
6262
codegen-units = 1

‎build.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ use vergen_git2::{Emitter, Git2Builder};
22

33
fn main() -> Result<(), Box<dyn std::error::Error>> {
44
// set VERGEN_GIT_SHA env variable based on git commit hash
5-
let git2 = Git2Builder::default().branch(true).sha(true).build()?;
5+
let git2 = Git2Builder::default().sha(true).build()?;
66
Emitter::default().add_instructions(&git2)?.emit()?;
77

88
tonic_prost_build::configure()

‎opnsense/Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
PLUGIN_NAME= defguard-gateway
2-
PLUGIN_VERSION= 1.0.1
2+
PLUGIN_VERSION= 2.0.0
33
PLUGIN_COMMENT= Gateway service for Defguard
44
PLUGIN_MAINTAINER= defguard@community.net
55

‎opnsense/src/etc/inc/plugins.inc.d/defguardgateway.inc‎

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ function defguardgateway_services()
77

88
$pidfile = (string) (new OPNsense\DefguardGateway\DefguardGateway())->general->PidFile;
99

10-
if (isset($config['OPNsense']['defguardgateway']['general']['enabled']) && $config['OPNsense']['defguardgateway']['general']['enabled'] == 1) {
10+
if (isset($config['OPNsense']['defguardgateway']['general']['Enabled']) && $config['OPNsense']['defguardgateway']['general']['Enabled'] == 1) {
1111
$services[] = [
1212
"description" => "Defguard Gateway",
1313
"configd" => [
@@ -41,24 +41,23 @@ function defguardgateway_interfaces()
4141

4242
function defguardgateway_devices()
4343
{
44-
$names = [];
45-
4644
$interface = (new OPNsense\DefguardGateway\DefguardGateway())->general
4745
->IfName;
46+
$interface = empty((string) $interface) ? 'wg0' : (string) $interface;
4847

4948
$devices[] = [
5049
"configurable" => false,
51-
"pattern" => "^wg",
50+
"pattern" => sprintf("^%s$", preg_quote($interface, '/')),
5251
"type" => "wireguard",
5352
"volatile" => true,
5453
"names" => [
55-
(string) $interface => [
54+
$interface => [
5655
"descr" => sprintf(
5756
"%s (Defguard Gateway)",
58-
(string) $interface
57+
$interface
5958
),
6059
"ifdescr" => "WireGuard interface used by Defguard Gateway",
61-
"name" => (string) $interface,
60+
"name" => $interface,
6261
],
6362
],
6463
];

‎opnsense/src/opnsense/mvc/app/controllers/OPNsense/DefguardGateway/forms/general.xml‎

Lines changed: 52 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,30 +6,26 @@
66
<help>Check to enable Defguard Gateway service.</help>
77
</field>
88
<field>
9-
<id>defguardgateway.general.Token</id>
10-
<label>Defguard VPN Location Auth Token</label>
9+
<id>defguardgateway.general.LogLevel</id>
10+
<label>Log level</label>
1111
<type>text</type>
12-
<help>Required: Token obtained from Defguard Core after network creation.</help>
13-
</field>
14-
<field>
15-
<id>defguardgateway.general.GrpcUrl</id>
16-
<label>Defguard Core gRPC URL</label>
17-
<type>text</type>
18-
<help>Required: URL of Defguard Core's gRPC service.</help>
19-
</field>
20-
<field>
21-
<id>defguardgateway.general.GrpcCertPath</id>
22-
<label>Path to custom SSL CA cerficiate</label>
23-
<type>text</type>
24-
<help>Required if custom SSL CA has been enabled in Defguard Core; more details here: https://docs.defguard.net/admin-and-features/setting-up-your-instance/grpc-ssl-communication#custom-ssl-ca-and-certificates.</help>
12+
<help>Set the application log level used when syslog is disabled.</help>
13+
<hint>Default value: info</hint>
2514
</field>
2615
<field>
2716
<id>defguardgateway.general.Name</id>
2817
<label>Gateway name</label>
2918
<type>text</type>
30-
<help>Name that will be displayed in Defguard</help>
19+
<help>Name that will be displayed in Defguard.</help>
3120
<hint>Gateway OPNsense</hint>
3221
</field>
22+
<field>
23+
<id>defguardgateway.general.GrpcPort</id>
24+
<label>Gateway gRPC port</label>
25+
<type>text</type>
26+
<help>Port used by the gateway gRPC server.</help>
27+
<hint>Default value: 50066</hint>
28+
</field>
3329
<field>
3430
<id>defguardgateway.general.UseSyslog</id>
3531
<label>Use syslog</label>
@@ -61,15 +57,15 @@
6157
<id>defguardgateway.general.IfName</id>
6258
<label>Network interface</label>
6359
<type>text</type>
64-
<help>Specify the WireGuard interface name</help>
60+
<help>Specify the WireGuard interface name. It must start with wg.</help>
6561
<hint>Default value: wg0</hint>
6662
</field>
6763
<field>
6864
<id>defguardgateway.general.StatsPeriod</id>
6965
<label>Stats gathering period</label>
7066
<type>text</type>
71-
<help>Specify the stats period in seconds</help>
72-
<hint>Default value: 60.</hint>
67+
<help>Specify how often interface statistics are sent, in seconds.</help>
68+
<hint>Default value: 30</hint>
7369
</field>
7470
<field>
7571
<id>defguardgateway.general.Userspace</id>
@@ -101,4 +97,41 @@
10197
<type>text</type>
10298
<help>Command to run after bringing down the interface.</help>
10399
</field>
100+
<field>
101+
<id>defguardgateway.general.HealthPort</id>
102+
<label>Health port</label>
103+
<type>text</type>
104+
<help>Optional HTTP port exposing the gateway health endpoint.</help>
105+
</field>
106+
<field>
107+
<id>defguardgateway.general.Masquerade</id>
108+
<label>Enable masquerade</label>
109+
<type>checkbox</type>
110+
<help>Automatically apply outbound masquerading rules in the firewall.</help>
111+
</field>
112+
<field>
113+
<id>defguardgateway.general.FwPriority</id>
114+
<label>Firewall priority</label>
115+
<type>text</type>
116+
<help>Optional priority for the Defguard forward chain.</help>
117+
</field>
118+
<field>
119+
<id>defguardgateway.general.DisableFirewallManagement</id>
120+
<label>Disable firewall management</label>
121+
<type>checkbox</type>
122+
<help>Disable Defguard-managed firewall changes for incompatible hardware or custom setups.</help>
123+
</field>
124+
<field>
125+
<id>defguardgateway.general.HttpBindAddress</id>
126+
<label>HTTP bind address</label>
127+
<type>text</type>
128+
<help>Optional IPv4 or IPv6 address used by the health endpoint.</help>
129+
</field>
130+
<field>
131+
<id>defguardgateway.general.CertDir</id>
132+
<label>Certificate directory</label>
133+
<type>text</type>
134+
<help>Directory where the gateway stores generated gRPC certificates.</help>
135+
<hint>Default value: /etc/defguard/certs</hint>
136+
</field>
104137
</form>

‎opnsense/src/opnsense/mvc/app/models/OPNsense/DefguardGateway/DefguardGateway.xml‎

Lines changed: 40 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,20 +11,20 @@
1111
<default>0</default>
1212
<Required>Y</Required>
1313
</Userspace>
14-
<Token type="TextField">
14+
<LogLevel type="TextField">
15+
<default>info</default>
1516
<Required>Y</Required>
16-
<ValidationMessage>please add authorization token</ValidationMessage>
17-
</Token>
18-
<GrpcUrl type="TextField">
19-
<Required>Y</Required>
20-
<ValidationMessage>please specify Defguard Core gRPC URL</ValidationMessage>
21-
</GrpcUrl>
22-
<GrpcCertPath type="TextField">
23-
<Required>N</Required>
24-
</GrpcCertPath>
17+
</LogLevel>
2518
<Name type="TextField">
2619
<Required>N</Required>
2720
</Name>
21+
<GrpcPort type="IntegerField">
22+
<default>50066</default>
23+
<Required>Y</Required>
24+
<MinimumValue>1</MinimumValue>
25+
<MaximumValue>65535</MaximumValue>
26+
<ValidationMessage>please specify a valid TCP/UDP port between 1 and 65535</ValidationMessage>
27+
</GrpcPort>
2828
<UseSyslog type="BooleanField">
2929
<default>0</default>
3030
<Required>Y</Required>
@@ -44,10 +44,12 @@
4444
<IfName type="TextField">
4545
<Required>Y</Required>
4646
<default>wg0</default>
47+
<Mask>/^wg[0-9]*$/</Mask>
48+
<ValidationMessage>please specify a valid interface name starting with wg</ValidationMessage>
4749
</IfName>
4850
<StatsPeriod type="IntegerField">
4951
<Required>Y</Required>
50-
<default>60</default>
52+
<default>30</default>
5153
</StatsPeriod>
5254
<PreUp type="TextField">
5355
<Required>N</Required>
@@ -61,6 +63,33 @@
6163
<PostDown type="TextField">
6264
<Required>N</Required>
6365
</PostDown>
66+
<HealthPort type="IntegerField">
67+
<Required>N</Required>
68+
<MinimumValue>1</MinimumValue>
69+
<MaximumValue>65535</MaximumValue>
70+
<ValidationMessage>please specify a valid port number (1-65535)</ValidationMessage>
71+
</HealthPort>
72+
<Masquerade type="BooleanField">
73+
<default>0</default>
74+
<Required>Y</Required>
75+
</Masquerade>
76+
<FwPriority type="IntegerField">
77+
<Required>N</Required>
78+
</FwPriority>
79+
<DisableFirewallManagement type="BooleanField">
80+
<default>0</default>
81+
<Required>Y</Required>
82+
</DisableFirewallManagement>
83+
<HttpBindAddress type="NetworkField">
84+
<Required>N</Required>
85+
<NetMaskAllowed>N</NetMaskAllowed>
86+
<NetMaskRequired>N</NetMaskRequired>
87+
<ValidationMessage>please specify a valid IP address</ValidationMessage>
88+
</HttpBindAddress>
89+
<CertDir type="TextField">
90+
<default>/etc/defguard/certs</default>
91+
<Required>Y</Required>
92+
</CertDir>
6493
</general>
6594
</items>
6695
</model>

0 commit comments

Comments
 (0)