diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-01-12 17:02:03 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-01-12 17:02:03 +0100 |
| commit | cd227a71ad752db9de2d2088125d07d51242b946 (patch) | |
| tree | cb19eda7783a0050bd81294fb52c7cb316b1f026 /data | |
| parent | 4df792f23ea229eb43dbbdb29088354519ef9596 (diff) | |
| parent | 5c4c873f9c36459bc7bad73208450ee802440929 (diff) | |
| download | vyos-1x-cd227a71ad752db9de2d2088125d07d51242b946.tar.gz vyos-1x-cd227a71ad752db9de2d2088125d07d51242b946.zip | |
Merge pull request #2807 from nicolas-fort/T5922
T5922: firewall: fix intra-zone filtering parsing rules; update firew…
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/firewall/nftables-zone.j2 | 13 | ||||
| -rw-r--r-- | data/templates/firewall/nftables.j2 | 4 |
2 files changed, 5 insertions, 12 deletions
diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2 index 5e55099ca..e78725079 100644 --- a/data/templates/firewall/nftables-zone.j2 +++ b/data/templates/firewall/nftables-zone.j2 @@ -1,13 +1,6 @@ - -{% macro zone_chains(zone, family, state_policy=False) %} -{% if family == 'ipv6' %} -{% set fw_name = 'ipv6_name' %} -{% set suffix = '6' %} -{% else %} -{% set fw_name = 'name' %} -{% set suffix = '' %} -{% endif %} - +{% macro zone_chains(zone, ipv6=False, state_policy=False) %} +{% set fw_name = 'ipv6_name' if ipv6 else 'name' %} +{% set suffix = '6' if ipv6 else '' %} chain VYOS_ZONE_FORWARD { type filter hook forward priority 1; policy accept; {% if state_policy %} diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index e0ad0e00a..833df3a67 100644 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -163,7 +163,7 @@ table ip vyos_filter { {{ group_tmpl.groups(group, False, True) }} {% if zone is vyos_defined %} -{{ zone_tmpl.zone_chains(zone, 'ipv4', global_options.state_policy is vyos_defined) }} +{{ zone_tmpl.zone_chains(zone, False, global_options.state_policy is vyos_defined) }} {% endif %} {% if global_options.state_policy is vyos_defined %} chain VYOS_STATE_POLICY { @@ -298,7 +298,7 @@ table ip6 vyos_filter { {% endif %} {{ group_tmpl.groups(group, True, True) }} {% if zone is vyos_defined %} -{{ zone_tmpl.zone_chains(zone, 'ipv6', global_options.state_policy is vyos_defined) }} +{{ zone_tmpl.zone_chains(zone, True, global_options.state_policy is vyos_defined) }} {% endif %} {% if global_options.state_policy is vyos_defined %} chain VYOS_STATE_POLICY6 { |