From 453fa8ab1f40067e03b639449b9ced88a98dc8f2 Mon Sep 17 00:00:00 2001 From: Jordan Potter Date: Tue, 8 Jun 2021 14:43:43 -0500 Subject: [PATCH] Clarify why net.ipv4.conf.all.src_valid_mark not set by WireGuard in entrypoint.sh --- entrypoint.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/entrypoint.sh b/entrypoint.sh index 8222236..86e2f98 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -22,7 +22,8 @@ if [[ "$(cat /proc/sys/net/ipv4/conf/all/src_valid_mark)" != "1" ]]; then exit 1 fi -sed -i "s:sysctl -q net.ipv4.conf.all.src_valid_mark=1:echo skipping setting net.ipv4.conf.all.src_valid_mark:" /usr/bin/wg-quick +# The net.ipv4.conf.all.src_valid_mark sysctl is set when running the Docker container, so don't have WireGuard also set it +sed -i "s:sysctl -q net.ipv4.conf.all.src_valid_mark=1:echo Skipping setting net.ipv4.conf.all.src_valid_mark:" /usr/bin/wg-quick wg-quick up $interface # IPv4 kill switch: traffic must be either (1) to the WireGuard interface, (2) marked as a WireGuard packet, (3) to a local address, or (4) to the Docker network