summaryrefslogtreecommitdiff
path: root/data/templates/firewall/nftables-policy.j2
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2022-11-17 17:52:03 +0100
committerGitHub <noreply@github.com>2022-11-17 17:52:03 +0100
commita295c8fd127c02e1af1a8051961ee2b8e2850fd1 (patch)
tree51acc8b143c2733c6ee5dc2b88a7bf7610c6df57 /data/templates/firewall/nftables-policy.j2
parent4545c51f37e89bc876da759c26e85eb2d65da004 (diff)
parent586b24e0af1ae57c47c772229fc94ab50dfc1e4f (diff)
downloadvyos-1x-a295c8fd127c02e1af1a8051961ee2b8e2850fd1.tar.gz
vyos-1x-a295c8fd127c02e1af1a8051961ee2b8e2850fd1.zip
Merge pull request #1654 from sarthurdev/pbr_refactor
policy: T2199: T4605: Migrate policy route interface node
Diffstat (limited to 'data/templates/firewall/nftables-policy.j2')
-rw-r--r--data/templates/firewall/nftables-policy.j231
1 files changed, 20 insertions, 11 deletions
diff --git a/data/templates/firewall/nftables-policy.j2 b/data/templates/firewall/nftables-policy.j2
index 40118930b..6cb3b2f95 100644
--- a/data/templates/firewall/nftables-policy.j2
+++ b/data/templates/firewall/nftables-policy.j2
@@ -2,21 +2,24 @@
{% import 'firewall/nftables-defines.j2' as group_tmpl %}
-{% if cleanup_commands is vyos_defined %}
-{% for command in cleanup_commands %}
-{{ command }}
-{% endfor %}
+{% if first_install is not vyos_defined %}
+delete table ip vyos_mangle
+delete table ip6 vyos_mangle
{% endif %}
-
-table ip mangle {
-{% if first_install is vyos_defined %}
+table ip vyos_mangle {
chain VYOS_PBR_PREROUTING {
type filter hook prerouting priority -150; policy accept;
+{% if route is vyos_defined %}
+{% for route_text, conf in route.items() if conf.interface is vyos_defined %}
+ iifname { {{ ",".join(conf.interface) }} } counter jump VYOS_PBR_{{ route_text }}
+{% endfor %}
+{% endif %}
}
+
chain VYOS_PBR_POSTROUTING {
type filter hook postrouting priority -150; policy accept;
}
-{% endif %}
+
{% if route is vyos_defined %}
{% for route_text, conf in route.items() %}
chain VYOS_PBR_{{ route_text }} {
@@ -32,15 +35,20 @@ table ip mangle {
{{ group_tmpl.groups(firewall_group, False) }}
}
-table ip6 mangle {
-{% if first_install is vyos_defined %}
+table ip6 vyos_mangle {
chain VYOS_PBR6_PREROUTING {
type filter hook prerouting priority -150; policy accept;
+{% if route6 is vyos_defined %}
+{% for route_text, conf in route6.items() if conf.interface is vyos_defined %}
+ iifname { {{ ",".join(conf.interface) }} } counter jump VYOS_PBR6_{{ route_text }}
+{% endfor %}
+{% endif %}
}
+
chain VYOS_PBR6_POSTROUTING {
type filter hook postrouting priority -150; policy accept;
}
-{% endif %}
+
{% if route6 is vyos_defined %}
{% for route_text, conf in route6.items() %}
chain VYOS_PBR6_{{ route_text }} {
@@ -52,5 +60,6 @@ table ip6 mangle {
}
{% endfor %}
{% endif %}
+
{{ group_tmpl.groups(firewall_group, True) }}
}