vyos-1x.git/data/templates/firewall/nftables-zone.j2, branch feature/T9082-codeql-cpp

firewall: T8761: re-introduce VRF interface names in generated firewall config

2026-07-01T19:51:21+00:00

This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig

firewall: T7739: Default ruleset for firewall zones

2025-10-21T23:46:37+00:00

In large networks with many zones where simple allow/deny rules are not sufficient, zones become tedious to manage. Many use cases can be simplified by providing an ability to define a default ruleset for traffic from other zones. This change proposes adding the follwing syntax: set firewall zone default_firewall name set firewall zone default_firewall ipv6_name The proposed behavior is the following: local in: The default firewall ruleset for the local zone will be appended after all from configurations. local out: If a non-local zone does not have a from local ruleset but does have a default_firewall ruleset, the default_firewall ruleset will be appended using oifname forward: The default firewall ruleset for the zone will be appended after all from configurations To keep the behavior consistent with from ruleset configurations, a return is appended after the default_firewall ruleset. The proposed behavior differs slightly from the default_policy configuration for the local out chains. The default_policy applied in the out templates comes from the local zone, not the actual outbound zone. The proposed change does not amend this, but does make default_firewall logically consistent with the intent of the out rules.

firewall: T7452: update rule generation for Zone-based firewall

2025-06-30T06:28:40+00:00

vrf: T7544: Ensure correct quoting for VRF ifnames in nftables

2025-06-26T14:23:13+00:00

* For VRF create/delete: * Simple dquoting, as before, was parsed away by the shell * Just escaping the double quotes could cause issues with the shell mangling VRF names (however unlikely) * Wrapping original quotes in shell-escaped single quotes is a quick & easy way to guard against both improper shell parsing and string names being taken as nft keywords. * Firewall configuration: * Firewall "interface name" rules support VRF ifnames and used them unquoted, fixed for nft_rule template tags (parse_rule) * Went through and quoted all iif/oifname usage by zones and interface groups. VRF ifnames weren't available for all cases, but there is no harm in completeness. * For this, also created a simple quoted_join template filter to replace any use of |join(',') * PBR calls nft but doesn't mind the "vni" name - table IDs used instead I may have missed some niche nft use-cases that would be exposed to this problem.

T6841: firewall: Fixed issues in ZBF when using VRFs

2025-01-06T11:05:22+00:00

Improve config parsing for ZBF when using VRFs and interfaces attached to VRFs

T6841: firewall: improve config parsing for ZBF when using VRFs and interfaces attached to VRFs

2025-01-06T11:05:22+00:00

T5922: firewall: fix intra-zone filtering parsing rules; update firewall smoketest

2024-01-12T13:52:26+00:00

T5775: firewall: re-add state-policy to firewall. These commands are now included in node.

2023-11-24T10:24:48+00:00

T5637: firewall: extend rule for default-action to firewall bridge, in order to be able to catch logs using separte rule for default-action

2023-11-22T11:38:00+00:00

T5541: firewall zone: re add firewall zone-base firewall

2023-10-13T14:12:58+00:00