WGDashboard ACL Options

[NoirPi]

I’ve been experimenting a bit to set up automatic restrictions between my peers.

The idea was to use the admin panel to define specific CIDR ranges or individual IP addresses for which traffic would be allowed. As a result, I’ve created a custom solution that is currently sufficient for my needs, which can be found here:
https://gist.github.com/NoirPi/4dc53ed61f543639bef0d9e499759044

However, I believe it would be a great enhancement if similar functionality could be integrated directly into the WGDashboard. This would make it easier for users to configure network restrictions and control traffic between peers without the need for external scripts or manual firewall adjustments.

Feature Proposal: Allowed and Denied Destinations

The idea is to add an interface in the WGDashboard where users can define Allowed Destinations and Denied Destinations for each peer. This could be done with the following configurable options:

• Allowed Destinations: A list of IP addresses or CIDR ranges (with optional ports) that the peer is allowed to communicate with.
• Denied Destinations: A list of IP addresses or CIDR ranges (with optional ports) that the peer is specifically denied access to.

Both options would allow users to add rules that automatically generate the necessary firewall rules in the backend.

Example of the Functionality:

• IP/CIDR Input Field: Users can enter a list of IP addresses or CIDR blocks.
• Port Selection (optional): The ability to define which ports are allowed or denied.
• Automatic Rule Generation: Once the destination lists are saved, the system would automatically generate and apply the necessary firewall rules using iptables or nftables, depending on the configuration.
• Optional Toggle: Users can enable or disable this feature per peer, allowing for more granular control.

This functionality could be useful in various use cases, such as:

• Restricting traffic to only certain IP ranges within a network.
• Denying access to specific external services or IPs.
• Simplifying peer-to-peer traffic control without needing to manually configure firewall rules outside of WGDashboard.

UI/UX Implementation Ideas:

1. Allowed/Denied Destinations Tab: A new tab or section in the peer configuration where users can manage the IP and port rules.
2. Rule Preview: A preview feature that shows the generated firewall rules based on the input, giving users transparency about what changes will be applied.
3. Validation: Built-in validation for the IP/CIDR formats and port numbers, ensuring the entered data is correct before applying the rules.
4. Error Handling: If for any reason the firewall rules can’t be applied, the dashboard should show a warning or error message to notify the user.
5. Advanced Options: For more advanced users, the ability to manually edit or customize the generated rules.

---

By adding this feature, WGDashboard could provide a more comprehensive solution for users who want to control traffic on a peer-to-peer level without needing to resort to external scripts or manual firewall configurations. It would streamline the process and make WireGuard more accessible to users who may not be familiar with network security or firewall management but still need to enforce specific access rules.

This is just a rough idea, and I'm sure there could be further improvements or adjustments, but I think it would be a useful addition to the WGDashboard.

[diegovilo]

It is the function that I am looking to implement, for the moment I will probably do it using iptables by hand, but it would be excellent to be able to use it in work networks