summaryrefslogtreecommitdiff
path: root/data/templates/firewall/nftables-zone.j2
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2023-11-22 13:24:04 +0100
committerGitHub <noreply@github.com>2023-11-22 13:24:04 +0100
commit8f853daa22fe2f822dae0574bf0bb35607d460a8 (patch)
tree592e6be8a7b22152f45284c217d12310f7f1234c /data/templates/firewall/nftables-zone.j2
parent9a5785c698d5a2819a4c51dfe3536ff83106a0c8 (diff)
parentc45b695ca068f018910eb7513e01657adb7abbbe (diff)
downloadvyos-1x-8f853daa22fe2f822dae0574bf0bb35607d460a8.tar.gz
vyos-1x-8f853daa22fe2f822dae0574bf0bb35607d460a8.zip
Merge pull request #2528 from nicolas-fort/T5637-Extend-bridge
T5637: firewall: extend rule for default-action to firewall bridge
Diffstat (limited to 'data/templates/firewall/nftables-zone.j2')
-rw-r--r--data/templates/firewall/nftables-zone.j218
1 files changed, 12 insertions, 6 deletions
diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2
index 1e9351f97..beb14ff00 100644
--- a/data/templates/firewall/nftables-zone.j2
+++ b/data/templates/firewall/nftables-zone.j2
@@ -1,7 +1,13 @@
-{% macro zone_chains(zone, ipv6=False) %}
-{% set fw_name = 'ipv6_name' if ipv6 else 'name' %}
-{% set suffix = '6' if ipv6 else '' %}
+{% macro zone_chains(zone, family) %}
+{% if family == 'ipv6' %}
+{% set fw_name = 'ipv6_name' %}
+{% set suffix = '6' %}
+{% else %}
+{% set fw_name = 'name' %}
+{% set suffix = '' %}
+{% endif %}
+
chain VYOS_ZONE_FORWARD {
type filter hook forward priority 1; policy accept;
{% for zone_name, zone_conf in zone.items() %}
@@ -36,7 +42,7 @@
iifname { {{ zone[from_zone].interface | join(",") }} } counter return
{% endfor %}
{% endif %}
- {{ zone_conf | nft_default_rule('zone_' + zone_name) }}
+ {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
chain VZONE_{{ zone_name }}_OUT {
oifname lo counter return
@@ -46,7 +52,7 @@
oifname { {{ zone[from_zone].interface | join(",") }} } counter return
{% endfor %}
{% endif %}
- {{ zone_conf | nft_default_rule('zone_' + zone_name) }}
+ {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
{% else %}
chain VZONE_{{ zone_name }} {
@@ -62,7 +68,7 @@
{% endif %}
{% endfor %}
{% endif %}
- {{ zone_conf | nft_default_rule('zone_' + zone_name) }}
+ {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
{% endif %}
{% endfor %}