summaryrefslogtreecommitdiff
path: root/data/vyos-firewall-init.conf
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2024-01-30 11:10:23 +0000
committerGitHub <noreply@github.com>2024-01-30 11:10:23 +0000
commite13d901fd903f69dad4c02152ebb4ff4ad858c7c (patch)
tree19623f23e2a6b088b066710614aead58b2af846a /data/vyos-firewall-init.conf
parente79fd8fff6de28a603bc861253f01f544dd25797 (diff)
parenta009143a62caca207fdffffcf0b490c747a87025 (diff)
downloadvyos-1x-e13d901fd903f69dad4c02152ebb4ff4ad858c7c.tar.gz
vyos-1x-e13d901fd903f69dad4c02152ebb4ff4ad858c7c.zip
Merge pull request #2877 from c-po/vrf-5973
vrf: T5973: multiple bugfixes and improvements
Diffstat (limited to 'data/vyos-firewall-init.conf')
-rw-r--r--data/vyos-firewall-init.conf19
1 files changed, 19 insertions, 0 deletions
diff --git a/data/vyos-firewall-init.conf b/data/vyos-firewall-init.conf
index cd7d5011f..5a4e03015 100644
--- a/data/vyos-firewall-init.conf
+++ b/data/vyos-firewall-init.conf
@@ -54,3 +54,22 @@ table ip6 raw {
type filter hook prerouting priority -300; policy accept;
}
}
+
+# Required by VRF
+table inet vrf_zones {
+ # Map of interfaces and connections tracking zones
+ map ct_iface_map {
+ typeof iifname : ct zone
+ }
+ # Assign unique zones for each VRF
+ # Chain for inbound traffic
+ chain vrf_zones_ct_in {
+ type filter hook prerouting priority raw; policy accept;
+ counter ct original zone set iifname map @ct_iface_map
+ }
+ # Chain for locally-generated traffic
+ chain vrf_zones_ct_out {
+ type filter hook output priority raw; policy accept;
+ counter ct original zone set oifname map @ct_iface_map
+ }
+}