[PATCH] man: wg-quick: kill-switch rules for firewalld

[PATCH] man: wg-quick: kill-switch rules for firewalld

[Sotir Danailov]

Signed-off-by: Sotir Danailov <sndanailov@gmail.com>
---
 src/man/wg-quick.8 | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/man/wg-quick.8 b/src/man/wg-quick.8
index b84eb64..9f8414e 100644
--- a/src/man/wg-quick.8
+++ b/src/man/wg-quick.8
@@ -156,6 +156,13 @@ two lines `PostUp` and `PreDown` lines to the `[Interface]` section:
     \fBPreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT\fP
 .br
 
+When using `firewalld', the ``kill-switch'' can be done like so:
+
+    \fBPostUp = firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && firewall-cmd --reload\fP
+.br
+    \fBPreDown = firewall-cmd --permanent --direct --remove-rule ipv4 filter OUTPUT 0 ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && firewall-cmd --reload\fP
+.br
+
 The `PostUp' and `PreDown' fields have been added to specify an
 .BR iptables (8)
 command which, when used with interfaces that have a peer that specifies 0.0.0.0/0 as part of the
-- 
2.37.1