diff options
| author | Christian Poessinger <christian@poessinger.com> | 2022-04-19 19:54:40 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-04-19 19:54:40 +0200 |
| commit | 07af15bb39f6a52a4fd240f54e22b518908fed53 (patch) | |
| tree | 0e30774eabfe4e0db0cbcaf944b46d601933f4bd /data/templates/firewall | |
| parent | 87ccc4626ad290518ee2a4c2b77f049c754ab186 (diff) | |
| parent | bf8f30b5f87c62fa81f7fba4212493f0f2bc6375 (diff) | |
| download | vyos-1x-07af15bb39f6a52a4fd240f54e22b518908fed53.tar.gz vyos-1x-07af15bb39f6a52a4fd240f54e22b518908fed53.zip | |
Merge pull request #1289 from nicolas-fort/T4365
NAT: T4365: Fix for nat tables manipulation on netfilter
Diffstat (limited to 'data/templates/firewall')
| -rw-r--r-- | data/templates/firewall/nftables-nat.tmpl | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/data/templates/firewall/nftables-nat.tmpl b/data/templates/firewall/nftables-nat.tmpl index 922f3dcb4..7a925b264 100644 --- a/data/templates/firewall/nftables-nat.tmpl +++ b/data/templates/firewall/nftables-nat.tmpl @@ -138,8 +138,9 @@ {% endif %} {% endmacro %} -# Start with clean NAT table -flush table ip nat +# Start with clean SNAT and DNAT chains +flush chain ip nat PREROUTING +flush chain ip nat POSTROUTING {% if helper_functions is vyos_defined('remove') %} {# NAT if going to be disabled - remove rules and targets from nftables #} {% set base_command = 'delete rule ip raw' %} @@ -164,6 +165,7 @@ add rule ip raw NAT_CONNTRACK counter accept # # Destination NAT rules build up here # +add rule ip nat PREROUTING counter jump VYOS_PRE_DNAT_HOOK {% if destination.rule is vyos_defined %} {% for rule, config in destination.rule.items() if config.disable is not vyos_defined %} {{ nat_rule(rule, config, 'PREROUTING') }} @@ -172,6 +174,7 @@ add rule ip raw NAT_CONNTRACK counter accept # # Source NAT rules build up here # +add rule ip nat POSTROUTING counter jump VYOS_PRE_SNAT_HOOK {% if source.rule is vyos_defined %} {% for rule, config in source.rule.items() if config.disable is not vyos_defined %} {{ nat_rule(rule, config, 'POSTROUTING') }} |