diff options
| author | Christian Breunig <christian@breunig.cc> | 2023-12-16 08:22:15 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-12-16 08:22:15 +0100 |
| commit | 9afd896937ba25dcbc03c6b217e08fcd80494c08 (patch) | |
| tree | 061dc7a5abb02ee75881bcca78b318ce7f7c4ed2 /data/templates/firewall/nftables-zone.j2 | |
| parent | af2668c4479377063c2e65e2383648155fb1e8f4 (diff) | |
| parent | 601616c022d938d39eeeab26673f01a6f7238bf3 (diff) | |
| download | vyos-1x-9afd896937ba25dcbc03c6b217e08fcd80494c08.tar.gz vyos-1x-9afd896937ba25dcbc03c6b217e08fcd80494c08.zip | |
Merge pull request #2597 from GurliGebis/T5775-sagitta-backport
T5775: firewall: re-add state-policy to firewall. (manual backport #2539)
Diffstat (limited to 'data/templates/firewall/nftables-zone.j2')
| -rw-r--r-- | data/templates/firewall/nftables-zone.j2 | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2 index ee468c6c1..506ad815e 100644 --- a/data/templates/firewall/nftables-zone.j2 +++ b/data/templates/firewall/nftables-zone.j2 @@ -1,8 +1,11 @@ -{% macro zone_chains(zone, ipv6=False) %} +{% macro zone_chains(zone, ipv6=False, state_policy=False) %} {% set fw_name = 'ipv6_name' if ipv6 else 'name' %} {% set suffix = '6' if ipv6 else '' %} chain VYOS_ZONE_FORWARD { type filter hook forward priority 1; policy accept; +{% if state_policy %} + jump VYOS_STATE_POLICY{{ suffix }} +{% endif %} {% for zone_name, zone_conf in zone.items() %} {% if 'local_zone' not in zone_conf %} oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE_{{ zone_name }} @@ -11,6 +14,9 @@ } chain VYOS_ZONE_LOCAL { type filter hook input priority 1; policy accept; +{% if state_policy %} + jump VYOS_STATE_POLICY{{ suffix }} +{% endif %} {% for zone_name, zone_conf in zone.items() %} {% if 'local_zone' in zone_conf %} counter jump VZONE_{{ zone_name }}_IN @@ -19,6 +25,9 @@ } chain VYOS_ZONE_OUTPUT { type filter hook output priority 1; policy accept; +{% if state_policy %} + jump VYOS_STATE_POLICY{{ suffix }} +{% endif %} {% for zone_name, zone_conf in zone.items() %} {% if 'local_zone' in zone_conf %} counter jump VZONE_{{ zone_name }}_OUT |