summaryrefslogtreecommitdiff
path: root/data/templates/firewall
diff options
context:
space:
mode:
authorIgor Melnyk <igor_melnyk@ukr.net>2021-06-26 10:48:54 +0300
committerGitHub <noreply@github.com>2021-06-26 09:48:54 +0200
commit166d44b32813c9dd64c3857beaf5eac8382b2d6d (patch)
tree3e4b7bd63ada6ff76c40d12e576d8b163e1017d0 /data/templates/firewall
parent3ffe114e8e8916d142b82657bd982122e57d17ed (diff)
downloadvyos-1x-166d44b32813c9dd64c3857beaf5eac8382b2d6d.tar.gz
vyos-1x-166d44b32813c9dd64c3857beaf5eac8382b2d6d.zip
nat: T1083: add translation options for persistent/random mapping of address and port
Tested using: set destination rule 100 inbound-interface 'eth0' set destination rule 100 translation address '19.13.23.42' set destination rule 100 translation options address-mapping 'random' set destination rule 100 translation options port-mapping 'none' set source rule 1000 outbound-interface 'eth0' set source rule 1000 translation address '122.233.231.12' set source rule 1000 translation options address-mapping 'persistent' set source rule 1000 translation options port-mapping 'fully-random'
Diffstat (limited to 'data/templates/firewall')
-rw-r--r--data/templates/firewall/nftables-nat.tmpl23
1 files changed, 23 insertions, 0 deletions
diff --git a/data/templates/firewall/nftables-nat.tmpl b/data/templates/firewall/nftables-nat.tmpl
index b80fc1968..e2776e9c2 100644
--- a/data/templates/firewall/nftables-nat.tmpl
+++ b/data/templates/firewall/nftables-nat.tmpl
@@ -73,6 +73,26 @@
{% set trns_addr = 'return' %}
{% set trns_port = '' %}
{% endif %}
+{# T1083: NAT address and port translation options #}
+{% if config.translation.options is defined and config.translation.options is not none %}
+{% if config.translation.options.address_mapping is defined and config.translation.options.address_mapping == "persistent" %}
+{% set trns_opts_addr = 'persistent' %}
+{% endif %}
+{% if config.translation.options.port_mapping is defined %}
+{% if config.translation.options.port_mapping == "random" %}
+{% set trns_opts_port = 'random' %}
+{% elif config.translation.options.port_mapping == "fully-random" %}
+{% set trns_opts_port = 'fully-random' %}
+{% endif %}
+{% endif %}
+{% endif %}
+{% if trns_opts_addr and trns_opts_port %}
+{% set trns_opts = trns_opts_addr + ',' + trns_opts_port %}
+{% elif trns_opts_addr %}
+{% set trns_opts = trns_opts_addr %}
+{% elif trns_opts_port %}
+{% set trns_opts = trns_opts_port %}
+{% endif %}
{% set output = 'add rule ip nat ' + chain + interface %}
{% if protocol != 'all' %}
{% set output = output + ' ip protocol ' + protocol %}
@@ -104,6 +124,9 @@
{# e.g. 192.0.2.10:3389 #}
{% set output = output + trns_port %}
{% endif %}
+{% if trns_opts %}
+{% set output = output + ' ' + trns_opts %}
+{% endif %}
{% if comment %}
{% set output = output + ' comment "' + comment + '"' %}
{% endif %}