diff options
| author | Daniil Baturin <daniil@vyos.io> | 2023-12-07 15:21:04 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-07 15:21:04 +0000 |
| commit | f604c177c5182719674c6540006eb10571bc81a4 (patch) | |
| tree | fa9eec1af54e4117e926877aa83afcdcff32166d /data/templates/firewall/nftables-zone.j2 | |
| parent | 264f23b95090ada20eef796525383697a06c13cb (diff) | |
| parent | 4ded8814f036b921a04a54850ca6717aafe91a52 (diff) | |
| download | vyos-1x-f604c177c5182719674c6540006eb10571bc81a4.tar.gz vyos-1x-f604c177c5182719674c6540006eb10571bc81a4.zip | |
Merge pull request #2539 from nicolas-fort/T5775
T5775: firewall: re-add state-policy to firewall. These commands are …
Diffstat (limited to 'data/templates/firewall/nftables-zone.j2')
| -rw-r--r-- | data/templates/firewall/nftables-zone.j2 | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2 index beb14ff00..5e55099ca 100644 --- a/data/templates/firewall/nftables-zone.j2 +++ b/data/templates/firewall/nftables-zone.j2 @@ -1,5 +1,5 @@ -{% macro zone_chains(zone, family) %} +{% macro zone_chains(zone, family, state_policy=False) %} {% if family == 'ipv6' %} {% set fw_name = 'ipv6_name' %} {% set suffix = '6' %} @@ -10,6 +10,9 @@ chain VYOS_ZONE_FORWARD { type filter hook forward priority 1; policy accept; +{% if state_policy %} + jump VYOS_STATE_POLICY{{ suffix }} +{% endif %} {% for zone_name, zone_conf in zone.items() %} {% if 'local_zone' not in zone_conf %} oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE_{{ zone_name }} @@ -18,6 +21,9 @@ } chain VYOS_ZONE_LOCAL { type filter hook input priority 1; policy accept; +{% if state_policy %} + jump VYOS_STATE_POLICY{{ suffix }} +{% endif %} {% for zone_name, zone_conf in zone.items() %} {% if 'local_zone' in zone_conf %} counter jump VZONE_{{ zone_name }}_IN @@ -26,6 +32,9 @@ } chain VYOS_ZONE_OUTPUT { type filter hook output priority 1; policy accept; +{% if state_policy %} + jump VYOS_STATE_POLICY{{ suffix }} +{% endif %} {% for zone_name, zone_conf in zone.items() %} {% if 'local_zone' in zone_conf %} counter jump VZONE_{{ zone_name }}_OUT |