diff options
| author | Simon <965089+sarthurdev@users.noreply.github.com> | 2025-11-24 20:48:07 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-11-24 20:48:07 +0100 |
| commit | fdda826b48688e253c30d3578ca5edd45b034ab0 (patch) | |
| tree | e23d2dce4f302de5157604501188894a2abd31c5 /data/templates | |
| parent | 1aec97d70ceaba9f89db8c592478e10ed1c0aefc (diff) | |
| parent | cc5895fe61f938189e229dffb7746fc93aac0f3b (diff) | |
| download | vyos-1x-fdda826b48688e253c30d3578ca5edd45b034ab0.tar.gz vyos-1x-fdda826b48688e253c30d3578ca5edd45b034ab0.zip | |
Merge pull request #4672 from apschultz/zone_default_firewall_ruleset
firewall: T7739: Default ruleset for firewall zones
Diffstat (limited to 'data/templates')
| -rw-r--r-- | data/templates/firewall/nftables-zone.j2 | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2 index 5a2b8912e..7b4128082 100644 --- a/data/templates/firewall/nftables-zone.j2 +++ b/data/templates/firewall/nftables-zone.j2 @@ -56,6 +56,10 @@ {% endif %} {% endfor %} {% endif %} +{% if zone_conf.default_firewall is vyos_defined and zone_conf.default_firewall[fw_name] is vyos_defined %} + counter jump NAME{{ suffix }}_{{ zone_conf.default_firewall[fw_name] }} + counter return +{% endif %} {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }} } chain VZONE_{{ zone_name }}_OUT { @@ -72,6 +76,20 @@ {% endif %} {% endfor %} {% endif %} +{% if zone_conf.default_local is vyos_defined %} +{% for from_zone, from_conf in zone_conf.default_local.items() if from_conf[fw_name] is vyos_defined %} +{% if 'interface' in zone[from_zone].member %} + oifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf[fw_name] }} + oifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter return +{% endif %} +{% if 'vrf' in zone[from_zone].member %} +{% for vrf_name in zone[from_zone].member.vrf %} + oifname { "{{ zone[from_zone]['vrf_interfaces'][vrf_name] }}" } counter jump NAME{{ suffix }}_{{ from_conf[fw_name] }} + oifname { "{{ zone[from_zone]['vrf_interfaces'][vrf_name] }}" } counter return +{% endfor %} +{% endif %} +{% endfor %} +{% endif %} {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }} } {% else %} @@ -104,6 +122,10 @@ {% endif %} {% endfor %} {% endif %} +{% if zone_conf.default_firewall is vyos_defined and zone_conf.default_firewall[fw_name] is vyos_defined %} + counter jump NAME{{ suffix }}_{{ zone_conf.default_firewall[fw_name] }} + counter return +{% endif %} {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }} } {% endif %} |