@@ -733,9 +733,16 @@ func (i *iptablesManager) AddAclRules(server string, aclRules map[string]models.
733733 }
734734 if len (aclRule .IPList ) > 0 {
735735 allowedIps := []string {}
736+ dstAllowedIps := []string {}
736737 for _ , ip := range aclRule .IPList {
737738 allowedIps = append (allowedIps , ip .String ())
738739 }
740+ if len (aclRule .Dst ) > 0 {
741+ for _ , ip := range aclRule .Dst {
742+ dstAllowedIps = append (dstAllowedIps , ip .String ())
743+ }
744+ }
745+
739746 rulesSpec := [][]string {}
740747 if len (aclRule .AllowedPorts ) > 0 {
741748
@@ -744,6 +751,9 @@ func (i *iptablesManager) AddAclRules(server string, aclRules map[string]models.
744751 continue
745752 }
746753 ruleSpec := []string {"-s" , strings .Join (allowedIps , "," )}
754+ if len (dstAllowedIps ) > 0 {
755+ ruleSpec = append (ruleSpec , "-d" , strings .Join (dstAllowedIps , "," ))
756+ }
747757 if aclRule .AllowedProtocol .String () != "" && aclRule .AllowedProtocol != models .ALL {
748758 ruleSpec = append (ruleSpec , "-p" , aclRule .AllowedProtocol .String ())
749759 }
@@ -759,6 +769,9 @@ func (i *iptablesManager) AddAclRules(server string, aclRules map[string]models.
759769
760770 } else {
761771 ruleSpec := []string {"-s" , strings .Join (allowedIps , "," )}
772+ if len (dstAllowedIps ) > 0 {
773+ ruleSpec = append (ruleSpec , "-d" , strings .Join (dstAllowedIps , "," ))
774+ }
762775 if aclRule .AllowedProtocol .String () != "" && aclRule .AllowedProtocol != models .ALL {
763776 ruleSpec = append (ruleSpec , "-p" , aclRule .AllowedProtocol .String ())
764777 }
@@ -786,9 +799,15 @@ func (i *iptablesManager) AddAclRules(server string, aclRules map[string]models.
786799
787800 if len (aclRule .IP6List ) > 0 {
788801 allowedIps := []string {}
802+ dstAllowedIps := []string {}
789803 for _ , ip := range aclRule .IP6List {
790804 allowedIps = append (allowedIps , ip .String ())
791805 }
806+ if len (aclRule .Dst6 ) > 0 {
807+ for _ , ip := range aclRule .Dst6 {
808+ dstAllowedIps = append (dstAllowedIps , ip .String ())
809+ }
810+ }
792811 rulesSpec := [][]string {}
793812 if len (aclRule .AllowedPorts ) > 0 {
794813
@@ -797,6 +816,9 @@ func (i *iptablesManager) AddAclRules(server string, aclRules map[string]models.
797816 continue
798817 }
799818 ruleSpec := []string {"-s" , strings .Join (allowedIps , "," )}
819+ if len (dstAllowedIps ) > 0 {
820+ ruleSpec = append (ruleSpec , "-d" , strings .Join (dstAllowedIps , "," ))
821+ }
800822 if aclRule .AllowedProtocol .String () != "" && aclRule .AllowedProtocol != models .ALL {
801823 ruleSpec = append (ruleSpec , "-p" , aclRule .AllowedProtocol .String ())
802824 }
@@ -812,6 +834,9 @@ func (i *iptablesManager) AddAclRules(server string, aclRules map[string]models.
812834
813835 } else {
814836 ruleSpec := []string {"-s" , strings .Join (allowedIps , "," )}
837+ if len (dstAllowedIps ) > 0 {
838+ ruleSpec = append (ruleSpec , "-d" , strings .Join (dstAllowedIps , "," ))
839+ }
815840 if aclRule .AllowedProtocol .String () != "" && aclRule .AllowedProtocol != models .ALL {
816841 ruleSpec = append (ruleSpec , "-p" , aclRule .AllowedProtocol .String ())
817842 }
@@ -864,16 +889,25 @@ func (i *iptablesManager) UpsertAclRule(server string, aclRule models.AclRule) {
864889 }
865890 if len (aclRule .IPList ) > 0 {
866891 allowedIps := []string {}
892+ dstAllowedIps := []string {}
867893 for _ , ip := range aclRule .IPList {
868894 allowedIps = append (allowedIps , ip .String ())
869895 }
896+ if len (aclRule .Dst ) > 0 {
897+ for _ , ip := range aclRule .Dst {
898+ dstAllowedIps = append (dstAllowedIps , ip .String ())
899+ }
900+ }
870901 rulesSpec := [][]string {}
871902 if len (aclRule .AllowedPorts ) > 0 {
872903 for _ , port := range aclRule .AllowedPorts {
873904 if port == "" {
874905 continue
875906 }
876907 ruleSpec := []string {"-s" , strings .Join (allowedIps , "," )}
908+ if len (dstAllowedIps ) > 0 {
909+ ruleSpec = append (ruleSpec , "-d" , strings .Join (dstAllowedIps , "," ))
910+ }
877911 if aclRule .AllowedProtocol .String () != "" {
878912 ruleSpec = append (ruleSpec , "-p" , aclRule .AllowedProtocol .String ())
879913 }
@@ -889,6 +923,9 @@ func (i *iptablesManager) UpsertAclRule(server string, aclRule models.AclRule) {
889923
890924 } else {
891925 ruleSpec := []string {"-s" , strings .Join (allowedIps , "," )}
926+ if len (dstAllowedIps ) > 0 {
927+ ruleSpec = append (ruleSpec , "-d" , strings .Join (dstAllowedIps , "," ))
928+ }
892929 if aclRule .AllowedProtocol .String () != "" {
893930 ruleSpec = append (ruleSpec , "-p" , aclRule .AllowedProtocol .String ())
894931 }
@@ -915,9 +952,15 @@ func (i *iptablesManager) UpsertAclRule(server string, aclRule models.AclRule) {
915952 }
916953 if len (aclRule .IP6List ) > 0 {
917954 allowedIps := []string {}
955+ dstAllowedIps := []string {}
918956 for _ , ip := range aclRule .IP6List {
919957 allowedIps = append (allowedIps , ip .String ())
920958 }
959+ if len (aclRule .Dst6 ) > 0 {
960+ for _ , ip := range aclRule .Dst6 {
961+ dstAllowedIps = append (dstAllowedIps , ip .String ())
962+ }
963+ }
921964 rulesSpec := [][]string {}
922965 if len (aclRule .AllowedPorts ) > 0 {
923966
@@ -926,6 +969,9 @@ func (i *iptablesManager) UpsertAclRule(server string, aclRule models.AclRule) {
926969 continue
927970 }
928971 ruleSpec := []string {"-s" , strings .Join (allowedIps , "," )}
972+ if len (dstAllowedIps ) > 0 {
973+ ruleSpec = append (ruleSpec , "-d" , strings .Join (dstAllowedIps , "," ))
974+ }
929975 if aclRule .AllowedProtocol .String () != "" {
930976 ruleSpec = append (ruleSpec , "-p" , aclRule .AllowedProtocol .String ())
931977 }
@@ -940,6 +986,9 @@ func (i *iptablesManager) UpsertAclRule(server string, aclRule models.AclRule) {
940986
941987 } else {
942988 ruleSpec := []string {"-s" , strings .Join (allowedIps , "," )}
989+ if len (dstAllowedIps ) > 0 {
990+ ruleSpec = append (ruleSpec , "-d" , strings .Join (dstAllowedIps , "," ))
991+ }
943992 if aclRule .AllowedProtocol .String () != "" {
944993 ruleSpec = append (ruleSpec , "-p" , aclRule .AllowedProtocol .String ())
945994 }
0 commit comments