VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=T6732-build-image-circinus 2022-05-28T13:20:13+00:00 2022-05-28T13:20:13+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2022-05-17T21:30:50+00:00 urn:sha1:e990b2f4c045f5d1be02915ec7d8869d5475ed4e Domain group allows to filter addresses by domain main Resolved addresses as elements are stored to named "nft set" that used in the nftables rules Also added a dynamic "resolver" systemd daemon vyos-domain-group-resolve.service which starts python script for the domain-group addresses resolving by timeout 300 sec set firewall group domain-group DOMAINS address 'example.com' set firewall group domain-group DOMAINS address 'example.org' set firewall name FOO rule 10 action 'drop' set firewall name FOO rule 10 source group domain-group 'DOMAINS' set interfaces ethernet eth0 firewall local name 'FOO' nft list table ip filter table ip filter { set DOMAINS { type ipv4_addr flags interval elements = { 192.0.2.1, 192.0.2.85, 203.0.113.55, 203.0.113.58 } } chain NAME_FOO { ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10" counter packets 0 bytes 0 return comment "FOO default-action accept" } } 2022-01-18T19:35:03+00:00 sarthurdev 965089+sarthurdev@users.noreply.github.com 2022-01-18T14:29:03+00:00 urn:sha1:0a5a78621b2b28f06af1f40c10ee8bb880f860a0 2021-12-06T20:20:49+00:00 sarthurdev 965089+sarthurdev@users.noreply.github.com 2021-07-28T10:03:21+00:00 urn:sha1:fdeba8da3e99256fe449e331d0b833a941315226 2021-05-25T20:17:16+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2021-05-25T20:17:16+00:00 urn:sha1:654c8cad2daaf84a07e4664d2c0469a863a46bdc Add XML for configuration mode firewall. Used for future rewriting it to Python style.