diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2023-08-26 23:02:10 +0200 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2023-08-26 23:20:22 +0200 |
| commit | 6b5d3568b88fad9cda694c0cd8b82c1f16773b15 (patch) | |
| tree | 22360fa716d82bcde58025885ed78c6acb5bae47 /data/templates/firewall | |
| parent | 75aa90cf2b234a34565d165697196ac9a304bb66 (diff) | |
| download | vyos-1x-6b5d3568b88fad9cda694c0cd8b82c1f16773b15.tar.gz vyos-1x-6b5d3568b88fad9cda694c0cd8b82c1f16773b15.zip | |
firewall: T5080: Disable conntrack unless required by rules
Diffstat (limited to 'data/templates/firewall')
| -rw-r--r-- | data/templates/firewall/nftables.j2 | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index 84af0449a..0fbddfaa9 100644 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -2,6 +2,21 @@ {% import 'firewall/nftables-defines.j2' as group_tmpl %} +flush chain raw FW_CONNTRACK +flush chain ip6 raw FW_CONNTRACK + +table raw { + chain FW_CONNTRACK { + {{ ipv4_conntrack_action }} + } +} + +table ip6 raw { + chain FW_CONNTRACK { + {{ ipv6_conntrack_action }} + } +} + {% if first_install is not vyos_defined %} delete table inet vyos_global_rpfilter {% endif %} |