Update

services/firewall/install.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+echo "Setting up firewall..."
+
+apk add -u awall # important -u flag!
+apk add ip6tables iptables
+modprobe -v ip_tables
+modprobe -v ip6_tables
+#modprobe -v iptable_nat #if NAT is used
+
+# Register services
+rc-update add iptables
+rc-update add ip6tables
+rc-service iptables start
+rc-service ip6tables start
+
+# In the global policy, LAN rules are omitted, as we are behind a NAT router.
+# If not, add this to global.policy.json:
+#         "LAN": { "iface": "eth1" },
+# ...
+#   { "in": "LAN", "action": "accept" },
+#   { "out": "LAN", "action": "accept" },

services/wireguard/vpn_traffic.policy.json

@@ -0,0 +1,12 @@
+{
+    "description": "Allow VPN traffic through Wireguard interface",
+    "filter": [
+        {
+            "in": "VPN",
+            "out": "_fw",
+            "service": [ "ssh", "dns", "ping", "http", "https" ],
+            "action": "accept",
+            "src": "10.0.0.1/24"
+        }
+    ]
+}