From 1772c0a7232789e6eeb0caa78fe630fab899522d Mon Sep 17 00:00:00 2001 From: Nicolas Fort Date: Thu, 7 Sep 2023 20:30:50 +0000 Subject: T4072: add firewall bridge filtering. First implementation only applies for forward chain and few matchers. Should be extended in the future. --- data/templates/firewall/nftables.j2 | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) (limited to 'data/templates/firewall/nftables.j2') diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index 0fbddfaa9..bb14609b0 100644 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -1,6 +1,7 @@ #!/usr/sbin/nft -f {% import 'firewall/nftables-defines.j2' as group_tmpl %} +{% import 'firewall/nftables-bridge.j2' as bridge_tmpl %} flush chain raw FW_CONNTRACK flush chain ip6 raw FW_CONNTRACK @@ -147,7 +148,7 @@ table ip vyos_filter { {% endfor %} {% endif %} {% endif %} -{{ group_tmpl.groups(group, False) }} +{{ group_tmpl.groups(group, False, True) }} } {% if first_install is not vyos_defined %} @@ -250,5 +251,16 @@ table ip6 vyos_filter { {% endfor %} {% endif %} {% endif %} -{{ group_tmpl.groups(group, True) }} -} \ No newline at end of file +{{ group_tmpl.groups(group, True, True) }} +} + +## Bridge Firewall +{% if first_install is not vyos_defined %} +delete table bridge vyos_filter +{% endif %} +{% if bridge is vyos_defined %} +table bridge vyos_filter { +{{ bridge_tmpl.bridge(bridge) }} +{{ group_tmpl.groups(group, False, False) }} +} +{% endif %} -- cgit v1.2.3