diff options
| author | Christian Breunig <christian@breunig.cc> | 2023-08-27 12:33:15 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-08-27 12:33:15 +0200 |
| commit | d3edda22573fb9c9d1c469f14f5a3eec9ca512a5 (patch) | |
| tree | c6118e7d1dc94b2963f69b7c504738320fb0a809 /data/templates/firewall/nftables.j2 | |
| parent | 904cbe448c578905c9af1d15059f2905c490e409 (diff) | |
| parent | 6b5d3568b88fad9cda694c0cd8b82c1f16773b15 (diff) | |
| download | vyos-1x-d3edda22573fb9c9d1c469f14f5a3eec9ca512a5.tar.gz vyos-1x-d3edda22573fb9c9d1c469f14f5a3eec9ca512a5.zip | |
Merge pull request #2176 from sarthurdev/T5080
firewall: T5080: Disable conntrack unless required by rules
Diffstat (limited to 'data/templates/firewall/nftables.j2')
| -rw-r--r-- | data/templates/firewall/nftables.j2 | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index 84af0449a..0fbddfaa9 100644 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -2,6 +2,21 @@ {% import 'firewall/nftables-defines.j2' as group_tmpl %} +flush chain raw FW_CONNTRACK +flush chain ip6 raw FW_CONNTRACK + +table raw { + chain FW_CONNTRACK { + {{ ipv4_conntrack_action }} + } +} + +table ip6 raw { + chain FW_CONNTRACK { + {{ ipv6_conntrack_action }} + } +} + {% if first_install is not vyos_defined %} delete table inet vyos_global_rpfilter {% endif %} |