vyos-1x.git/interface-definitions/firewall.xml.in, branch fix/T8955-http-api-verify-tlsVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=fix%2FT8955-http-api-verify-tls2025-11-24T19:48:07+00:00Merge pull request #4672 from apschultz/zone_default_firewall_ruleset2025-11-24T19:48:07+00:00Simon965089+sarthurdev@users.noreply.github.com2025-11-24T19:48:07+00:00urn:sha1:fdda826b48688e253c30d3578ca5edd45b034ab0
firewall: T7739: Default ruleset for firewall zonesT7849: ZBF allow to use wildcard interfaces as member2025-10-31T15:31:58+00:00Viacheslav Hletenkov.gletenko@vyos.io2025-10-31T15:25:03+00:00urn:sha1:b85fb0e04685d21b6f0dc4c0c1c8ee22105a971e
Allow to use wildcard interfaces for zone-based firewall
It should allow interfaces like ipoe*/pppoe*/l2tp*
firewall: T7739: Default ruleset for firewall zones2025-10-21T23:46:37+00:00Adam Schultzadam.schultz@live.com2025-08-17T02:29:11+00:00urn:sha1:cc5895fe61f938189e229dffb7746fc93aac0f3b
In large networks with many zones where simple allow/deny rules are not sufficient,
zones become tedious to manage. Many use cases can be simplified by providing an
ability to define a default ruleset for traffic from other zones. This change proposes
adding the follwing syntax:
set firewall zone <name> default_firewall name <name>
set firewall zone <name> default_firewall ipv6_name <name>
The proposed behavior is the following:
local in:
The default firewall ruleset for the local zone will be appended after all
from configurations.
local out:
If a non-local zone does not have a from local ruleset but does have a
default_firewall ruleset, the default_firewall ruleset will be appended using
oifname
forward:
The default firewall ruleset for the zone will be appended after all from
configurations
To keep the behavior consistent with from ruleset configurations, a return is appended
after the default_firewall ruleset.
The proposed behavior differs slightly from the default_policy configuration for the
local out chains. The default_policy applied in the out templates comes from the local
zone, not the actual outbound zone. The proposed change does not amend this, but does
make default_firewall logically consistent with the intent of the out rules.
firewall: T5493: Implement remote-group2025-03-21T20:08:50+00:00Alex Wembezzle.dev@proton.me2025-01-30T20:22:41+00:00urn:sha1:9e2bdc96ea63e7ee1adb002df17e0d9ecc1cd410T6841: firewall: re-use existing generic-interface-multi.xml.i XML building block2025-01-06T11:05:22+00:00Christian Breunigchristian@breunig.cc2024-12-23T12:14:11+00:00urn:sha1:3b04cc29f0baf618351d67b4d6aa47f55b54bb20T6841: firewall: Fixed issues in ZBF when using VRFs2025-01-06T11:05:22+00:00aapostoliuka.apostoliuk@vyos.io2024-12-17T11:39:49+00:00urn:sha1:4a194b32509ffcd9574bb7571a5a6347f7dc4e42
Improve config parsing for ZBF when using VRFs and interfaces attached to VRFs
T6841: firewall: improve config parsing for ZBF when using VRFs and interfaces attached to VRFs2025-01-06T11:05:22+00:00Nicolas Fortnicolasfort1988@gmail.com2024-10-29T19:05:52+00:00urn:sha1:df176d9b9b4cc67ae509ae2ff17a02f2520cc881T5794: change firewall priority in oder to be loaded after all interfaces.2024-08-15T17:37:59+00:00nicolasnicolas@deb-4all.nfort.local2024-08-15T17:37:59+00:00urn:sha1:b3ae35987a860a5d2cf64dfbc156a7ee7cc799a2T4072: firewall: extend firewall bridge capabilities, in order to include new chains, priorities, and firewall groups2024-08-01T16:25:31+00:00Nicolas Fortnicolasfort1988@gmail.com2024-07-24T14:08:19+00:00urn:sha1:20551379e8e2b4b6e342b39ea67738876e559bbfT3900: add support for raw table in firewall.2024-05-15T17:09:16+00:00Nicolas Fortnicolasfort1988@gmail.com2024-05-15T17:09:16+00:00urn:sha1:6871c5541c1962e63d7a9b75d2bb43df2a8d372b