diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2023-09-05 14:51:16 +0200 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2023-09-05 20:27:49 +0200 |
| commit | 0de3de1e0a78eb35b666b8f613d3e54fd3ad54e4 (patch) | |
| tree | 65634cc41a39f87eed6542e583649cca68dfb403 /data/vyos-firewall-init.conf | |
| parent | 0c8823c0021d45a791ef95eaca1516b900d8cb68 (diff) | |
| download | vyos-1x-0de3de1e0a78eb35b666b8f613d3e54fd3ad54e4.tar.gz vyos-1x-0de3de1e0a78eb35b666b8f613d3e54fd3ad54e4.zip | |
interface: T5550: Interface source-validation priority over global value
- Migrate IPv4 source-validation to nftables
- Interface source-validation value takes priority, fallback to global value
Diffstat (limited to 'data/vyos-firewall-init.conf')
| -rw-r--r-- | data/vyos-firewall-init.conf | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/data/vyos-firewall-init.conf b/data/vyos-firewall-init.conf index 41e7627f5..b0026fdf3 100644 --- a/data/vyos-firewall-init.conf +++ b/data/vyos-firewall-init.conf @@ -19,6 +19,15 @@ table raw { type filter hook forward priority -300; policy accept; } + chain vyos_global_rpfilter { + return + } + + chain vyos_rpfilter { + type filter hook prerouting priority -300; policy accept; + counter jump vyos_global_rpfilter + } + chain PREROUTING { type filter hook prerouting priority -300; policy accept; counter jump VYOS_CT_IGNORE @@ -82,8 +91,13 @@ table ip6 raw { type filter hook forward priority -300; policy accept; } + chain vyos_global_rpfilter { + return + } + chain vyos_rpfilter { type filter hook prerouting priority -300; policy accept; + counter jump vyos_global_rpfilter } chain PREROUTING { |