diff options
| author | Christian Breunig <christian@breunig.cc> | 2023-11-19 08:09:36 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-11-19 08:09:36 +0100 |
| commit | cd19b9d6b0c21a5d07a9f5a98e5e90d09d8d4cc9 (patch) | |
| tree | d50432807096a0a36438bc81d917462878ada25e /data/templates/firewall/nftables-bridge.j2 | |
| parent | b2c9187b95d7d94468997b66c185465b8bef354c (diff) | |
| parent | 2dc2df575bc4de60759a272f5e6880326501a7ef (diff) | |
| download | vyos-1x-cd19b9d6b0c21a5d07a9f5a98e5e90d09d8d4cc9.tar.gz vyos-1x-cd19b9d6b0c21a5d07a9f5a98e5e90d09d8d4cc9.zip | |
Merge pull request #2498 from nicolas-fort/T4072-sagitta
T4072: firewall: backport bridge firewall to sagitta
Diffstat (limited to 'data/templates/firewall/nftables-bridge.j2')
| -rw-r--r-- | data/templates/firewall/nftables-bridge.j2 | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/data/templates/firewall/nftables-bridge.j2 b/data/templates/firewall/nftables-bridge.j2 new file mode 100644 index 000000000..1a4ad2ed9 --- /dev/null +++ b/data/templates/firewall/nftables-bridge.j2 @@ -0,0 +1,35 @@ +{% macro bridge(bridge) %} +{% set ns = namespace(sets=[]) %} +{% if bridge.forward is vyos_defined %} +{% for prior, conf in bridge.forward.items() %} +{% set def_action = conf.default_action %} + chain VYOS_FORWARD_{{ prior }} { + type filter hook forward priority {{ prior }}; policy {{ def_action }}; +{% if conf.rule is vyos_defined %} +{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %} + {{ rule_conf | nft_rule('FWD', prior, rule_id, 'bri') }} +{% if rule_conf.recent is vyos_defined %} +{% set ns.sets = ns.sets + ['FWD_' + prior + '_' + rule_id] %} +{% endif %} +{% endfor %} +{% endif %} + } +{% endfor %} +{% endif %} + +{% if bridge.name is vyos_defined %} +{% for name_text, conf in bridge.name.items() %} + chain NAME_{{ name_text }} { +{% if conf.rule is vyos_defined %} +{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %} + {{ rule_conf | nft_rule('NAM', name_text, rule_id, 'bri') }} +{% if rule_conf.recent is vyos_defined %} +{% set ns.sets = ns.sets + ['NAM_' + name_text + '_' + rule_id] %} +{% endif %} +{% endfor %} +{% endif %} + {{ conf | nft_default_rule(name_text) }} + } +{% endfor %} +{% endif %} +{% endmacro %}
\ No newline at end of file |