summaryrefslogtreecommitdiff
path: root/data/templates
diff options
context:
space:
mode:
authorNicolas Fort <nicolasfort1988@gmail.com>2024-01-05 12:13:17 +0000
committerNicolas Fort <nicolasfort1988@gmail.com>2024-01-25 12:35:46 +0000
commit6ce5fedb602c5ea0df52049a5e9c4fb4f5a86122 (patch)
treec1260ee9efeddcf038bfcf547372efba17d26ba6 /data/templates
parentada6b103f15b5871fa28c5e194afcd2f5019b2e4 (diff)
downloadvyos-1x-6ce5fedb602c5ea0df52049a5e9c4fb4f5a86122.tar.gz
vyos-1x-6ce5fedb602c5ea0df52049a5e9c4fb4f5a86122.zip
T4839: firewall: Add dynamic address group in firewall configuration, and appropiate commands to populate such groups using source and destination address of the packet.
Diffstat (limited to 'data/templates')
-rw-r--r--data/templates/firewall/nftables-defines.j221
1 files changed, 21 insertions, 0 deletions
diff --git a/data/templates/firewall/nftables-defines.j2 b/data/templates/firewall/nftables-defines.j2
index a20c399ae..8a75ab2d6 100644
--- a/data/templates/firewall/nftables-defines.j2
+++ b/data/templates/firewall/nftables-defines.j2
@@ -98,5 +98,26 @@
}
{% endfor %}
{% endif %}
+
+{% if group.dynamic_group is vyos_defined %}
+{% if group.dynamic_group.address_group is vyos_defined and not is_ipv6 and is_l3 %}
+{% for group_name, group_conf in group.dynamic_group.address_group.items() %}
+ set DA_{{ group_name }} {
+ type {{ ip_type }}
+ flags dynamic, timeout
+ }
+{% endfor %}
+{% endif %}
+
+{% if group.dynamic_group.ipv6_address_group is vyos_defined and is_ipv6 and is_l3 %}
+{% for group_name, group_conf in group.dynamic_group.ipv6_address_group.items() %}
+ set DA6_{{ group_name }} {
+ type {{ ip_type }}
+ flags dynamic, timeout
+ }
+{% endfor %}
+{% endif %}
+{% endif %}
+
{% endif %}
{% endmacro %}