wiretastix

Configure Network Rules

How to create, list, and apply network rules in Wiretastix.

Wiretastix allows you to define and apply network rules to control traffic flow for your WireGuard peers. These rules are enforced using nftables on the Wiretastix daemon host.

1. Add a Rule

To create a new network rule, use the rule add command. Rules are not named, and there’s no raw nftables expression field – each rule is a set of structured key/value pairs (not --flags) that Wiretastix compiles into nftables rules itself, and each gets an auto-generated numeric ID.

wiretastix-cli
> rule add group developers nfproto ip4 l4proto tcp dport 22 action drop

Valid keys:

  • group: The OIDC name of the group this rule applies to (rules always target a group, not an individual user).
  • nfproto: Address family – ip4 or ip6.
  • l4proto: Transport protocol – tcp, udp, or icmp.
  • src / dst: Source/destination IP or CIDR.
  • sport / dport: Source/destination port.
  • action: accept, drop, or none.
> rule add group developers nfproto ip4 l4proto tcp dport 80 action accept
> rule add group developers nfproto ip4 l4proto tcp dport 443 action accept

rule add validates all of this immediately, rather than only failing silently the next time you run rule apply:

  • group and action are required.
  • sport/dport require l4proto to be tcp or udp – they don’t make sense with icmp or no l4proto at all.
  • src/dst must be given as a CIDR, including the mask (e.g. 10.0.1.0/24, not a bare 10.0.1.5), and its address family must match nfproto – an ip4 rule needs an IPv4 CIDR, ip6 needs an IPv6 CIDR.

2. List Rules

To view all configured network rules, use the rule list command:

> rule list

This displays a table with each rule’s numeric ID, group, protocol fields, and action. You’ll need a rule’s ID to delete it.

3. Delete a Rule

To remove a network rule, use the rule del command followed by its numeric ID (from rule list):

> rule del 3

4. Apply Rules

After creating or modifying rules, you must explicitly apply them to the nftables firewall. This command pushes all active rules from the Wiretastix database to the system’s nftables configuration.

> rule apply

Important: Rules are not active until you run rule apply. It is recommended to test your rules carefully before applying them in a production environment.

Next Steps

For more advanced interactions with Wiretastix, explore the Advanced CLI and API Usage guide.