summaryrefslogtreecommitdiff
path: root/data/templates
diff options
context:
space:
mode:
Diffstat (limited to 'data/templates')
-rw-r--r--data/templates/firewall/nftables-nat66.j212
-rw-r--r--data/templates/ids/fastnetmon.j210
-rw-r--r--data/templates/ids/fastnetmon_excluded_networks_list.j25
-rw-r--r--data/templates/ids/fastnetmon_networks_list.j24
-rw-r--r--data/templates/macsec/wpa_supplicant.conf.j210
-rw-r--r--data/templates/router-advert/radvd.conf.j22
-rw-r--r--data/templates/squid/squid.conf.j210
-rw-r--r--data/templates/ssh/override.conf.j23
8 files changed, 47 insertions, 9 deletions
diff --git a/data/templates/firewall/nftables-nat66.j2 b/data/templates/firewall/nftables-nat66.j2
index 003b138b2..ca19506f2 100644
--- a/data/templates/firewall/nftables-nat66.j2
+++ b/data/templates/firewall/nftables-nat66.j2
@@ -3,8 +3,10 @@
{% macro nptv6_rule(rule,config, chain) %}
{% set comment = '' %}
{% set base_log = '' %}
-{% set src_prefix = 'ip6 saddr ' ~ config.source.prefix if config.source.prefix is vyos_defined %}
-{% set dest_address = 'ip6 daddr ' ~ config.destination.address if config.destination.address is vyos_defined %}
+{% set dst_prefix = 'ip6 daddr ' ~ config.destination.prefix.replace('!','!= ') if config.destination.prefix is vyos_defined %}
+{% set src_prefix = 'ip6 saddr ' ~ config.source.prefix.replace('!','!= ') if config.source.prefix is vyos_defined %}
+{% set source_address = 'ip6 saddr ' ~ config.source.address.replace('!','!= ') if config.source.address is vyos_defined %}
+{% set dest_address = 'ip6 daddr ' ~ config.destination.address.replace('!','!= ') if config.destination.address is vyos_defined %}
{% if chain is vyos_defined('PREROUTING') %}
{% set comment = 'DST-NAT66-' ~ rule %}
{% set base_log = '[NAT66-DST-' ~ rule %}
@@ -52,6 +54,12 @@
{% if src_prefix is vyos_defined %}
{% set output = output ~ ' ' ~ src_prefix %}
{% endif %}
+{% if dst_prefix is vyos_defined %}
+{% set output = output ~ ' ' ~ dst_prefix %}
+{% endif %}
+{% if source_address is vyos_defined %}
+{% set output = output ~ ' ' ~ source_address %}
+{% endif %}
{% if dest_address is vyos_defined %}
{% set output = output ~ ' ' ~ dest_address %}
{% endif %}
diff --git a/data/templates/ids/fastnetmon.j2 b/data/templates/ids/fastnetmon.j2
index c482002fa..b9f77a257 100644
--- a/data/templates/ids/fastnetmon.j2
+++ b/data/templates/ids/fastnetmon.j2
@@ -1,21 +1,25 @@
# enable this option if you want to send logs to local syslog facility
+logging:logging_level = debug
logging:local_syslog_logging = on
# list of all your networks in CIDR format
-networks_list_path = /etc/networks_list
+networks_list_path = /run/fastnetmon/networks_list
# list networks in CIDR format which will be not monitored for attacks
-white_list_path = /etc/networks_whitelist
+white_list_path = /run/fastnetmon/excluded_networks_list
# Enable/Disable any actions in case of attack
enable_ban = on
+enable_ban_ipv6 = on
## How many packets will be collected from attack traffic
ban_details_records_count = 500
## How long (in seconds) we should keep an IP in blocked state
## If you set 0 here it completely disables unban capability
-ban_time = 1900
+{% if ban_time is vyos_defined %}
+ban_time = {{ ban_time }}
+{% endif %}
# Check if the attack is still active, before triggering an unban callback with this option
# If the attack is still active, check each run of the unban watchdog
diff --git a/data/templates/ids/fastnetmon_excluded_networks_list.j2 b/data/templates/ids/fastnetmon_excluded_networks_list.j2
new file mode 100644
index 000000000..c88a1c527
--- /dev/null
+++ b/data/templates/ids/fastnetmon_excluded_networks_list.j2
@@ -0,0 +1,5 @@
+{% if excluded_network is vyos_defined %}
+{% for net in excluded_network %}
+{{ net }}
+{% endfor %}
+{% endif %}
diff --git a/data/templates/ids/fastnetmon_networks_list.j2 b/data/templates/ids/fastnetmon_networks_list.j2
index 1c81180be..5f1b3ba4d 100644
--- a/data/templates/ids/fastnetmon_networks_list.j2
+++ b/data/templates/ids/fastnetmon_networks_list.j2
@@ -1,6 +1,4 @@
-{% if network is vyos_defined(var_type=str) %}
-{{ network }}
-{% else %}
+{% if network is vyos_defined() %}
{% for net in network %}
{{ net }}
{% endfor %}
diff --git a/data/templates/macsec/wpa_supplicant.conf.j2 b/data/templates/macsec/wpa_supplicant.conf.j2
index 0ac7cb860..1f7ba16f4 100644
--- a/data/templates/macsec/wpa_supplicant.conf.j2
+++ b/data/templates/macsec/wpa_supplicant.conf.j2
@@ -47,6 +47,12 @@ network={
# 1: Integrity only
macsec_integ_only={{ '0' if security.encrypt is vyos_defined else '1' }}
+ # macsec_csindex: IEEE 802.1X/MACsec cipher suite
+ # 0 = GCM-AES-128
+ # 1 = GCM-AES-256
+{# security.cipher is a mandatory key #}
+ macsec_csindex={{ '1' if security.cipher is vyos_defined('gcm-aes-256') else '0' }}
+
{% if security.encrypt is vyos_defined %}
# mka_cak, mka_ckn, and mka_priority: IEEE 802.1X/MACsec pre-shared key mode
# This allows to configure MACsec with a pre-shared key using a (CAK,CKN) pair.
@@ -83,5 +89,9 @@ network={
# 1..2^32-1: number of packets that could be misordered
macsec_replay_window={{ security.replay_window }}
{% endif %}
+
+ # macsec_port: IEEE 802.1X/MACsec port - Port component of the SCI
+ # Range: 1-65534 (default: 1)
+ macsec_port=1
}
diff --git a/data/templates/router-advert/radvd.conf.j2 b/data/templates/router-advert/radvd.conf.j2
index ed15b32f0..a464795ad 100644
--- a/data/templates/router-advert/radvd.conf.j2
+++ b/data/templates/router-advert/radvd.conf.j2
@@ -50,6 +50,8 @@ interface {{ iface }} {
AdvValidLifetime {{ prefix_options.valid_lifetime }};
AdvOnLink {{ 'off' if prefix_options.no_on_link_flag is vyos_defined else 'on' }};
AdvPreferredLifetime {{ prefix_options.preferred_lifetime }};
+ DeprecatePrefix {{ 'on' if prefix_options.deprecate_prefix is vyos_defined else 'off' }};
+ DecrementLifetimes {{ 'on' if prefix_options.decrement_lifetime is vyos_defined else 'off' }};
};
{% endfor %}
{% endif %}
diff --git a/data/templates/squid/squid.conf.j2 b/data/templates/squid/squid.conf.j2
index a0fdeb20e..5781c883f 100644
--- a/data/templates/squid/squid.conf.j2
+++ b/data/templates/squid/squid.conf.j2
@@ -2,6 +2,11 @@
acl net src all
acl SSL_ports port 443
+{% if ssl_safe_ports is vyos_defined %}
+{% for port in ssl_safe_ports %}
+acl SSL_ports port {{ port }}
+{% endfor %}
+{% endif %}
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
@@ -13,6 +18,11 @@ acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
+{% if safe_ports is vyos_defined %}
+{% for port in safe_ports %}
+acl Safe_ports port {{ port }}
+{% endfor %}
+{% endif %}
acl CONNECT method CONNECT
{% if authentication is vyos_defined %}
diff --git a/data/templates/ssh/override.conf.j2 b/data/templates/ssh/override.conf.j2
index e4d6f51cb..4454ad1b8 100644
--- a/data/templates/ssh/override.conf.j2
+++ b/data/templates/ssh/override.conf.j2
@@ -5,8 +5,9 @@ After=vyos-router.service
ConditionPathExists={{ config_file }}
[Service]
+EnvironmentFile=
ExecStart=
-ExecStart={{ vrf_command }}/usr/sbin/sshd -f {{ config_file }} -D $SSHD_OPTS
+ExecStart={{ vrf_command }}/usr/sbin/sshd -f {{ config_file }}
Restart=always
RestartPreventExitStatus=
RestartSec=10