GitLab/ocserv
1
0
Fork 0
mirror of https://gitlab.com/openconnect/ocserv.git synced 2026-08-09 09:51:49 +08:00
Code Issues Packages Projects Releases Wiki Activity

doc: updated for nft/iptables dependencies

Browse Source 
Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
This commit is contained in:
Nikos Mavrogiannopoulos
2026-05-02 18:49:43 +02:00
parent 4c85218f41
commit 8913ffadff
2 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9
View File
@@ -66,6 +66,15 @@ yum install -y rubygem-ronn-ng
See [README-radius](doc/README-radius.md) for more information on Radius See [README-radius](doc/README-radius.md) for more information on Radius
dependencies and its configuration. dependencies and its configuration.
# Runtime dependencies
When the `restrict-user-to-routes` or `restrict-user-to-ports` options are
configured, ocserv invokes `/usr/libexec/ocserv-fw` at runtime to enforce
firewall rules. That script requires either `nft` (nftables) or `iptables`
depending on the backend selected with the `-Dfirewall-script=` meson option
at build time. The default is `nftables` when `nft` is present at configure
time, otherwise `iptables`.
# Build instructions # Build instructions
``` ```
doc/sample.config
+4 -1
View File
@@ -688,10 +688,13 @@ no-route = 192.168.5.0/255.255.255.0
#no-udp = false #no-udp = false
# If set, the script /usr/libexec/ocserv-fw will be called to restrict # If set, the script /usr/libexec/ocserv-fw will be called to restrict
# the user to its allowed routes and prevent him from accessing # the user to its allowed routes and prevent them from accessing
# any other routes. In case of defaultroute, the no-routes are restricted. # any other routes. In case of defaultroute, the no-routes are restricted.
# All the routes applied by ocserv can be reverted using /usr/libexec/ocserv-fw # All the routes applied by ocserv can be reverted using /usr/libexec/ocserv-fw
# --removeall. This option can be set globally or in the per-user configuration. # --removeall. This option can be set globally or in the per-user configuration.
#
# Note: the ocserv-fw script requires either nft (nftables) or iptables at runtime,
# depending on the backend selected with -Dfirewall-script= at build time.
# [scope: vhost user] # [scope: vhost user]
#restrict-user-to-routes = true #restrict-user-to-routes = true