diff options
| author | Sebastian Weber <s@web3r.de> | 2024-01-17 21:48:51 +0100 |
|---|---|---|
| committer | Mergify <37929162+mergify[bot]@users.noreply.github.com> | 2024-01-19 20:07:30 +0000 |
| commit | 6ed85600b218a0457a1fd125c97314b1783e63bd (patch) | |
| tree | 53d6006076c45feb627b29c148ea44438173e5f7 | |
| parent | 3d927aa7ee2896a0e7c4ab0058fe40441eee20fc (diff) | |
| download | vyos-documentation-6ed85600b218a0457a1fd125c97314b1783e63bd.tar.gz vyos-documentation-6ed85600b218a0457a1fd125c97314b1783e63bd.zip | |
Fix typos in quick-start
(cherry picked from commit 32460e70ef014616ec36fce9361f702d5cc1463a)
# Conflicts:
# docs/quick-start.rst
| -rw-r--r-- | docs/quick-start.rst | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/docs/quick-start.rst b/docs/quick-start.rst index c8bb3f04..f0a3c828 100644 --- a/docs/quick-start.rst +++ b/docs/quick-start.rst @@ -158,8 +158,29 @@ Configure Stateful Packet Filtering With the new firewall structure, we have have a lot of flexibility in how we group and order our rules, as shown by the two alternative approaches below. +<<<<<<< HEAD Option 1: Common Chain ^^^^^^^^^^^^^^^^^^^^^^ +======= +Option 1: Global State Policies +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Using options defined in ``set firewall global-options state-policy``, state +policy rules that applies for both IPv4 and IPv6 are created. These global +state policies also applies for all traffic that passes through the router +(transit) and for traffic originated/destinated to/from the router itself, and +will be evaluated before any other rule defined in the firewall. + +Most installations would choose this option, and will contain: + +.. code-block:: none + + set firewall global-options state-policy established action accept + set firewall global-options state-policy related action accept + set firewall global-options state-policy invalid action drop + +Option 2: Common/Custom Chain +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +>>>>>>> 32460e70 (Fix typos in quick-start) We can create a common chain for stateful connection filtering of multiple interfaces (or multiple netfilter hooks on one interface). Those individual @@ -225,7 +246,7 @@ established and related connections, we can block all other incoming traffic addressed to our local network. Create a new chain (``OUTSIDE-IN``) which will drop all traffic that is not -explicity allowed at some point in the chain. Then, we can jump to that chain +explicitly allowed at some point in the chain. Then, we can jump to that chain from the ``forward`` hook when traffic is coming from the ``WAN`` interface group and is addressed to our local network. |