vyos-1x.git/data/templates/firewall/nftables-policy.j2, branch feature/T9082-codeql-cppVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp2026-01-21T10:52:29+00:00geoip: T7926: Refactor geoip handling2026-01-21T10:52:29+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2025-10-02T15:47:10+00:00urn:sha1:7f6f94370ec04ce48e7a19880a74ba0c25f7bfb5
* Move core logic to separate vyos.geoip module
* Use a sqlite database for storing and querying address ranges by country
* Remove downloaded geoip ranges once loaded into sqlite db
* No longer rebuild geoip sets on each commit unless necessary
* Allows for extensibility using other geoip data vendors
geoip: T5636: Add geoip for policy route/route62025-03-28T07:47:24+00:00sskajesskaje@gmail.com2025-03-28T07:47:24+00:00urn:sha1:795154d9009b669f8858ed983c6b7486aaee1125firewall: T5834: Add support for default log for route policy2023-12-27T03:49:42+00:00Indrajit Raychaudhuriirc@indrajit.com2023-12-27T01:19:10+00:00urn:sha1:6278ce9b7cb2060c8226a60ccbdb580a0d8a3fb5
One can now do `set policy route foo default-log` which will add log
to the policy route chain.
T4072: add firewall bridge filtering. First implementation only applies for forward chain and few matchers. Should be extended in the future.2023-09-07T20:30:50+00:00Nicolas Fortnicolasfort1988@gmail.com2023-09-07T20:30:50+00:00urn:sha1:1772c0a7232789e6eeb0caa78fe630fab899522dT5160: firewall refactor: new cli structure. Update jinja templates, python scripts and src firewall2023-08-11T14:40:55+00:00Nicolas Fortnicolasfort1988@gmail.com2023-05-23T17:53:57+00:00urn:sha1:a8244928af84e65dcc9833e14e2de3324b484977T5333: Set prefix UD for PBR generated user-defined chain names2023-07-03T11:34:10+00:00Viacheslav Hletenkov.gletenko@vyos.io2023-07-03T11:34:10+00:00urn:sha1:5cf503955377d138c626b2c8157eab71b1fa8fad
We cannot use some specific names like POSTROUTING/PREROUTING
as for PBR they overlaps with VyOS defined chains
Chains aftoconfigured by VyOS itself:
chain VYOS_PBR_PREROUTING
chain VYOS_PBR_POSTROUTING
If we try to use chain name "POSTROUTING" it generates 2 chains
with the same name "chain VYOS_PBR_POSTROUTING" one is
autoconfigured and the second defined by user
set policy route POSTROUTING rule 100
Add the user-defined (UD) prefix to separate user defined names
That allows to use any user-defined names
T5128: Policy Route: allow wildcard on interface2023-03-31T12:28:24+00:00Nicolas Fortnicolasfort1988@gmail.com2023-03-30T12:55:30+00:00urn:sha1:599c5405e7ff5b76aa774b8cc97a82fbc053d46cpolicy: T2199: T4605: Migrate policy route interface to `policy route|route6 <name> interface <ifname>`2022-11-11T15:37:56+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2022-11-02T14:32:11+00:00urn:sha1:586b24e0af1ae57c47c772229fc94ab50dfc1e4f
* Include refactor to policy route to allow for deletion of mangle table instead of complex cleanup
* T4605: Rename mangle table to vyos_mangle
policy-route: T4655: Remove default_action from template2022-09-01T10:43:01+00:00Viacheslav Hletenkov.gletenko@vyos.io2022-08-31T18:32:05+00:00urn:sha1:90d8219c8e9c9148ab9205f5cbf7ba583d9ef7e6
Remove `default_action` from template "nftables-policy" as XML
policy route does not use it
Set default action 'accept' for policy route, as default action
'drop' must be used only for firewall and not related to the
policy route
firewall: T4147: Use named sets for firewall groups2022-06-14T20:57:52+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2022-06-12T23:45:06+00:00urn:sha1:34db435e7a74ee8509777802e03927de2dd57627
* Refactor nftables clean-up code
* Adds policy route test for using firewall groups