Add WireGuard to the firewall rules documentation

[joestringer]

• docs: Word-wrap firewall section
• docs: Add WireGuard into the firewall rules

[joestringer]

/test

[brb]

Thanks!

[learnitall]

Nice catch, thank you for adding this! I think there are a couple of changes we could make to add more context to this.

• If WireGuard is enabled with tunnel mode, do users need to open firewall rules for VXLAN/Geneve and WireGuard, or just WireGuard, since packets bypass the VXLAN/Geneve tunnels when WireGuard is enabled? If users only need to open a port for WireGuard, can we add a statement saying so?
• If users need to open ports for WireGuard and VXLAN/Geneve, can we move the information for WireGuard into its own own paragraph, similar to IPSec?

[joestringer]

@brb can you help to answer the above questions?

[brb]

It's a bit tricky, as it depends on the encryption mode.

• With encryption.nodeEncryption=true, all traffic flows through the WireGuard tunnel device completely bypassing the VXLAN/Geneve tunnels.
• With encryption.nodeEncryption=false, the pod-to-pod traffic will bypass the VXLAN/Geneve tunnels, but the host-to-pod flows through the VXLAN/Geneve tunnels.

TL;DR with the node encryption enabled, there is no need to open ports for the VXLAN/Geneve tunnels.

[joestringer]

/test

Addressed feedback

[learnitall]

Looks great! Thanks!