Merge pull request #1134 from sarthurdev/firewall

firewall: zone-policy: T2199: T4130: Fixes for firewall, state-policy and zone-policy

2 files changed, 14 insertions, 10 deletions

diff --git a/data/templates/firewall/nftables.tmpl b/data/templates/firewall/nftables.tmpl
index bbb111b1f..68e83de64 100644
--- a/data/templates/firewall/nftables.tmpl
+++ b/data/templates/firewall/nftables.tmpl
@@ -46,11 +46,8 @@ define P_{{ group_name }} = {
 
 table ip filter {
 {% if first_install is defined %}
-    chain VYOS_FW_IN {
+    chain VYOS_FW_FORWARD {
         type filter hook forward priority 0; policy accept;
-    }
-    chain VYOS_FW_OUT {
-        type filter hook forward priority 1; policy accept;
         jump VYOS_POST_FW
     }
     chain VYOS_FW_LOCAL {
@@ -104,11 +101,8 @@ table ip filter {
 
 table ip6 filter {
 {% if first_install is defined %}
-    chain VYOS_FW6_IN {
+    chain VYOS_FW6_FORWARD {
         type filter hook forward priority 0; policy accept;
-    }
-    chain VYOS_FW6_OUT {
-        type filter hook forward priority 1; policy accept;
         jump VYOS_POST_FW6
     }
     chain VYOS_FW6_LOCAL {
diff --git a/data/templates/zone_policy/nftables.tmpl b/data/templates/zone_policy/nftables.tmpl
index 21230c688..fae6e8c4f 100644
--- a/data/templates/zone_policy/nftables.tmpl
+++ b/data/templates/zone_policy/nftables.tmpl
@@ -81,7 +81,7 @@ table ip6 filter {
 insert rule ip filter VYOS_FW_LOCAL counter jump VZONE_{{ zone_name }}_IN
 insert rule ip filter VYOS_FW_OUTPUT counter jump VZONE_{{ zone_name }}_OUT
 {%       else %}
-insert rule ip filter VYOS_FW_OUT oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE_{{ zone_name }}
+insert rule ip filter VYOS_FW_FORWARD oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE_{{ zone_name }}
 {%       endif %}
 {%     endif %}
 {%     if zone_conf.ipv6 %}
@@ -89,9 +89,19 @@ insert rule ip filter VYOS_FW_OUT oifname { {{ zone_conf.interface | join(',') }
 insert rule ip6 filter VYOS_FW6_LOCAL counter jump VZONE6_{{ zone_name }}_IN
 insert rule ip6 filter VYOS_FW6_OUTPUT counter jump VZONE6_{{ zone_name }}_OUT
 {%       else %}
-insert rule ip6 filter VYOS_FW6_OUT oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE6_{{ zone_name }}
+insert rule ip6 filter VYOS_FW6_FORWARD oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE6_{{ zone_name }}
 {%       endif %}
 {%     endif %}
 {%   endfor %}
 
+{# Ensure that state-policy rule is first in the chain #}
+{%   if firewall.state_policy is defined %}
+{%     for chain in ['VYOS_FW_FORWARD', 'VYOS_FW_OUTPUT', 'VYOS_FW_LOCAL'] %}
+insert rule ip filter {{ chain }} jump VYOS_STATE_POLICY
+{%     endfor %}
+{%     for chain in ['VYOS_FW6_FORWARD', 'VYOS_FW6_OUTPUT', 'VYOS_FW6_LOCAL'] %}
+insert rule ip6 filter {{ chain }} jump VYOS_STATE_POLICY6
+{%     endfor %}
+{%   endif %}
+
 {% endif %}