diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-09-11 07:48:49 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-09-11 07:48:49 +0200 |
| commit | 4bbd5c7c13f7ea72ba40813db0e6258ecf0a59f7 (patch) | |
| tree | 6f4de57bc5af3b482619a91ff1dfcf144214b4a8 /data | |
| parent | 7767fb40b4c4e48a73cbff88860b889302476d22 (diff) | |
| parent | f96733dd1e8d840012d98740006d7999a9fa6776 (diff) | |
| download | vyos-1x-4bbd5c7c13f7ea72ba40813db0e6258ecf0a59f7.tar.gz vyos-1x-4bbd5c7c13f7ea72ba40813db0e6258ecf0a59f7.zip | |
Merge pull request #4023 from nvollmar/T6679
T6679: add group option for nat66
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/firewall/nftables-nat66.j2 | 24 |
1 files changed, 15 insertions, 9 deletions
diff --git a/data/templates/firewall/nftables-nat66.j2 b/data/templates/firewall/nftables-nat66.j2 index 67eb2c109..09b5b6ac2 100644 --- a/data/templates/firewall/nftables-nat66.j2 +++ b/data/templates/firewall/nftables-nat66.j2 @@ -1,8 +1,11 @@ #!/usr/sbin/nft -f +{% import 'firewall/nftables-defines.j2' as group_tmpl %} + {% if first_install is not vyos_defined %} delete table ip6 vyos_nat {% endif %} +{% if deleted is not vyos_defined %} table ip6 vyos_nat { # # Destination NAT66 rules build up here @@ -10,11 +13,11 @@ table ip6 vyos_nat { chain PREROUTING { type nat hook prerouting priority -100; policy accept; counter jump VYOS_DNPT_HOOK -{% if destination.rule is vyos_defined %} -{% for rule, config in destination.rule.items() if config.disable is not vyos_defined %} - {{ config | nat_rule(rule, 'destination', ipv6=True) }} -{% endfor %} -{% endif %} +{% if destination.rule is vyos_defined %} +{% for rule, config in destination.rule.items() if config.disable is not vyos_defined %} + {{ config | nat_rule(rule, 'destination', ipv6=True) }} +{% endfor %} +{% endif %} } # @@ -23,11 +26,11 @@ table ip6 vyos_nat { chain POSTROUTING { type nat hook postrouting priority 100; policy accept; counter jump VYOS_SNPT_HOOK -{% if source.rule is vyos_defined %} -{% for rule, config in source.rule.items() if config.disable is not vyos_defined %} +{% if source.rule is vyos_defined %} +{% for rule, config in source.rule.items() if config.disable is not vyos_defined %} {{ config | nat_rule(rule, 'source', ipv6=True) }} -{% endfor %} -{% endif %} +{% endfor %} +{% endif %} } chain VYOS_DNPT_HOOK { @@ -37,4 +40,7 @@ table ip6 vyos_nat { chain VYOS_SNPT_HOOK { return } + +{{ group_tmpl.groups(firewall_group, True, True) }} } +{% endif %} |