WIP: openvpn

services/basic/global.policy.json

@@ -1,11 +1,16 @@
 {
     "description": "Restrict all internet access",
-    "variable": { "internet_if": "eth0" },
     "zone": {
-        "internet": { "iface": "$internet_if" }
+        "WAN": { "iface": "eth0" },
+        "LAN": { "iface": "eth1" },
+        "VPN": { "iface": "tun+" }
     },
     "policy": [
-        { "in": "internet", "action": "drop" },
+        { "in": "VPN", "action": "accept" },
+        { "out": "VPN", "action": "accept" },
+        { "in": "LAN", "action": "accept" },
+        { "out": "LAN", "action": "accept" },
+        { "in": "WAN", "action": "drop" },
         { "action": "reject" }
     ]
 }

services/basic/icmp.policy.json

@@ -2,7 +2,8 @@
     "description": "Allow ping-pong",
     "filter": [
         {
-            "in": "internet",
+            "in": "WAN",
+            "out": "_fw",
             "service": "ping",
             "action": "accept",
             "flow-limit": { "count": 10, "interval": 6 }

services/basic/outgoing.policy.json

@@ -3,7 +3,7 @@
     "filter": [
         {
             "in": "_fw",
-            "out": "internet",
+            "out": "WAN",
             "service": ["http", "https", "dns", "ssh", "ntp", "ping"],
             "action": "accept"
         }