ms2k/opnsense-nordvpn-plugin
SHA256
Watch
0
Code Releases Activity

Limit WireGuard exemption to NordVPN endpoints

Browse source
This commit is contained in:
ms2k 2026-08-03 01:03:22 +09:00
commit 1c3112245a
1 changed files with 27 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

54
docs/spec/opnsense-nordvpn-plugin-spec.md
View file

@ -23,21 +23,21 @@ flowchart LR
## Requirements ## Requirements
| Area | Requirement | | Area | Requirement |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Runtime | Health checking and reconciliation run on the OPNsense appliance. | | Runtime | Health checking and reconciliation run on the OPNsense appliance. |
| Configuration | Plugin configuration is available through the OPNsense WebGUI. | | Configuration | Plugin configuration is available through the OPNsense WebGUI. |
| Bootstrap | The WebGUI accepts a NordVPN Access Token to obtain the initial NordLynx private key. | | Bootstrap | The WebGUI accepts a NordVPN Access Token to obtain the initial NordLynx private key. |
| Location | The operator can select an allowlist of countries. An empty allowlist permits every country returned by NordVPN recommendations. | | Location | The operator can select an allowlist of countries. An empty allowlist permits every country returned by NordVPN recommendations. |
| Health | The plugin determines Tunnel Availability. | | Health | The plugin determines Tunnel Availability. |
| Failover | When the Managed Tunnel is unavailable, the plugin tries other eligible servers until the Managed Tunnel becomes available or no untried eligible server remains. | | Failover | When the Managed Tunnel is unavailable, the plugin tries other eligible servers until the Managed Tunnel becomes available or no untried eligible server remains. |
| Traffic enrollment | The operator configures the NordVPN Egress Enrollment through native OPNsense firewall selectors. The plugin does not maintain a separate address-membership model. | | Traffic enrollment | The operator configures the NordVPN Egress Enrollment through native OPNsense firewall selectors. The plugin does not maintain a separate address-membership model. |
| Enrollment warning | The WebGUI warns when the NordVPN Egress Enrollment can include an RFC 1918 destination address. | | Enrollment warning | The WebGUI warns when the NordVPN Egress Enrollment can include an RFC 1918 destination address. |
| Ownership | The operator owns referenced OPNsense aliases. The plugin owns the Managed Tunnel, its associated gateway, and its generated firewall rules. | | Ownership | The operator owns referenced OPNsense aliases. The plugin owns the Managed Tunnel, its associated gateway, and its generated firewall rules. |
| Direct egress | The operator can select the Direct Egress Gateway. | | Direct egress | The operator can select the Direct Egress Gateway. |
| Failure policy | Fail closed is the default. Fail open is an operator-selected option. | | Failure policy | Fail closed is the default. Fail open is an operator-selected option. |
| WireGuard exemption | An operator-selected toggle routes outbound UDP destination port `51820` traffic through the Direct Egress Gateway ahead of NordVPN policy routing. | | WireGuard exemption | An operator-selected toggle routes outbound UDP destination port `51820` traffic to NordVPN NordLynx server addresses through the Direct Egress Gateway ahead of NordVPN policy routing. |
| Repository data | Committed content contains no secrets or configuration values that identify or distinguish an actual deployment. | | Repository data | Committed content contains no secrets or configuration values that identify or distinguish an actual deployment. |
## Bootstrap ## Bootstrap
@ -76,7 +76,7 @@ flowchart TD
```mermaid ```mermaid
flowchart TD flowchart TD
Packet[Outbound IPv4 packet] --> Exemption{UDP destination port 51820 exemption enabled?} Packet[Outbound IPv4 packet] --> Exemption{NordVPN NordLynx destination on UDP port 51820 and exemption enabled?}
Exemption -->|yes| Direct[Direct Egress Gateway] Exemption -->|yes| Direct[Direct Egress Gateway]
Exemption -->|no| Enrolled{Matches NordVPN Egress Enrollment?} Exemption -->|no| Enrolled{Matches NordVPN Egress Enrollment?}
Enrolled -->|no| Native[Continue native OPNsense rule evaluation] Enrolled -->|no| Native[Continue native OPNsense rule evaluation]
@ -90,14 +90,14 @@ flowchart TD
## Acceptance ## Acceptance
| Capability | Required result | | Capability | Required result |
| ------------------- | --------------------------------------------------------------------------------------------------- | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| Bootstrap | The operator can obtain and configure the initial NordLynx private key through the WebGUI. | | Bootstrap | The operator can obtain and configure the initial NordLynx private key through the WebGUI. |
| Stable operation | A healthy Managed Tunnel retains its current server. | | Stable operation | A healthy Managed Tunnel retains its current server. |
| Failover | An unavailable Managed Tunnel changes to another eligible server when one establishes availability. | | Failover | An unavailable Managed Tunnel changes to another eligible server when one establishes availability. |
| Country selection | Selected servers satisfy the country allowlist when it is not empty. | | Country selection | Selected servers satisfy the country allowlist when it is not empty. |
| Traffic enrollment | Matching IPv4 traffic uses the Managed Tunnel gateway while the Managed Tunnel is available. | | Traffic enrollment | Matching IPv4 traffic uses the Managed Tunnel gateway while the Managed Tunnel is available. |
| Enrollment warning | The WebGUI warns when the NordVPN Egress Enrollment can include an RFC 1918 destination address. | | Enrollment warning | The WebGUI warns when the NordVPN Egress Enrollment can include an RFC 1918 destination address. |
| WireGuard exemption | When enabled, outbound UDP destination port `51820` traffic uses the Direct Egress Gateway. | | WireGuard exemption | When enabled, outbound UDP destination port `51820` traffic to NordVPN NordLynx server addresses uses the Direct Egress Gateway. |
| Fail closed | Matching IPv4 traffic is blocked while the Managed Tunnel is unavailable. | | Fail closed | Matching IPv4 traffic is blocked while the Managed Tunnel is unavailable. |
| Fail open | Matching IPv4 traffic uses the Direct Egress Gateway while the Managed Tunnel is unavailable. | | Fail open | Matching IPv4 traffic uses the Direct Egress Gateway while the Managed Tunnel is unavailable. |