add -s source for MASQUERADE rule

gravitl · Apr 23, 2024 · c7c86ec · c7c86ec
1 parent 0dc4fe6
commit c7c86ec
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/firewall/iptables_linux.go b/firewall/iptables_linux.go
@@ -306,7 +306,7 @@ func (i *iptablesManager) InsertEgressRoutingRules(server string, egressInfo mod
 			if err != nil {
 				logger.Log(0, "failed to get interface name: ", egressRangeIface, err.Error())
 			} else {
-				ruleSpec := []string{"-o", egressRangeIface, "-j", "MASQUERADE"}
+				ruleSpec := []string{"-s", egressInfo.Network.String(), "-o", egressRangeIface, "-j", "MASQUERADE"}
 				ruleSpec = appendNetmakerCommentToRule(ruleSpec)
 				// to avoid duplicate iface route rule,delete if exists
 				iptablesClient.DeleteIfExists(defaultNatTable, nattablePRTChain, ruleSpec...)

diff --git a/firewall/nftables_linux.go b/firewall/nftables_linux.go
@@ -305,7 +305,7 @@ func (n *nftablesManager) InsertEgressRoutingRules(server string, egressInfo mod
 			if egressRangeIface, err := getInterfaceName(config.ToIPNet(egressGwRange)); err != nil {
 				logger.Log(0, "failed to get interface name: ", egressRangeIface, err.Error())
 			} else {
-				ruleSpec := []string{"-o", egressRangeIface, "-j", "MASQUERADE"}
+				ruleSpec := []string{"-s", egressInfo.Network.String(), "-o", egressRangeIface, "-j", "MASQUERADE"}
 				// to avoid duplicate iface route rule,delete if exists
 				n.deleteRule(defaultNatTable, nattablePRTChain, genRuleKey(ruleSpec...))
 				rule = &nftables.Rule{