diff options
| author | Daniil Baturin <daniil@vyos.io> | 2025-08-26 16:08:23 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-08-26 16:08:23 +0100 |
| commit | 284ff768af3eb1fa3ce0d75d2516e428332edbd8 (patch) | |
| tree | ca28ef6f17105783597a6c88f07e64e0fff1d5a5 /data | |
| parent | 48db015c2ef1cea9cd9b2340e8a84d427a69d822 (diff) | |
| parent | 6ff6950ab9ebd8e24fecb0ef588244e25f49bce8 (diff) | |
| download | vyos-1x-284ff768af3eb1fa3ce0d75d2516e428332edbd8.tar.gz vyos-1x-284ff768af3eb1fa3ce0d75d2516e428332edbd8.zip | |
Merge pull request #4628 from ryanzuwala/ryanzuwala/T7482
conntrack: T7482: Fix custom timeouts
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/conntrack/nftables-ct.j2 | 32 |
1 files changed, 22 insertions, 10 deletions
diff --git a/data/templates/conntrack/nftables-ct.j2 b/data/templates/conntrack/nftables-ct.j2 index c753e6bcb..9169c1f55 100644 --- a/data/templates/conntrack/nftables-ct.j2 +++ b/data/templates/conntrack/nftables-ct.j2 @@ -16,17 +16,15 @@ table ip vyos_conntrack { {% endif %} return } - chain VYOS_CT_TIMEOUT { {% if timeout.custom.ipv4.rule is vyos_defined %} + chain VYOS_CT_TIMEOUT { {% for rule, rule_config in timeout.custom.ipv4.rule.items() %} # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }} {{ rule_config | conntrack_rule(rule, 'timeout', ipv6=False) }} {% endfor %} -{% endif %} return } -{% if timeout.custom.ipv4.rule is vyos_defined %} {% for rule, rule_config in timeout.custom.ipv4.rule.items() %} ct timeout ct-timeout-{{ rule }} { l3proto ip; @@ -36,12 +34,21 @@ table ip vyos_conntrack { {% endfor %} } {% endfor %} + + chain PREROUTING_CT_TIMEOUT { + type filter hook prerouting priority -199; policy accept; + counter jump VYOS_CT_TIMEOUT + } + + chain OUTPUT_CT_TIMEOUT { + type filter hook output priority -199; policy accept; + counter jump VYOS_CT_TIMEOUT + } {% endif %} chain PREROUTING { type filter hook prerouting priority -300; policy accept; counter jump VYOS_CT_IGNORE - counter jump VYOS_CT_TIMEOUT counter jump FW_CONNTRACK counter jump NAT_CONNTRACK counter jump WLB_CONNTRACK @@ -58,7 +65,6 @@ table ip vyos_conntrack { chain OUTPUT { type filter hook output priority -300; policy accept; counter jump VYOS_CT_IGNORE - counter jump VYOS_CT_TIMEOUT counter jump FW_CONNTRACK counter jump NAT_CONNTRACK {% if wlb_local_action %} @@ -106,17 +112,15 @@ table ip6 vyos_conntrack { {% endif %} return } - chain VYOS_CT_TIMEOUT { {% if timeout.custom.ipv6.rule is vyos_defined %} + chain VYOS_CT_TIMEOUT { {% for rule, rule_config in timeout.custom.ipv6.rule.items() %} # rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }} {{ rule_config | conntrack_rule(rule, 'timeout', ipv6=True) }} {% endfor %} -{% endif %} return } -{% if timeout.custom.ipv6.rule is vyos_defined %} {% for rule, rule_config in timeout.custom.ipv6.rule.items() %} ct timeout ct-timeout-{{ rule }} { l3proto ip; @@ -126,12 +130,21 @@ table ip6 vyos_conntrack { {% endfor %} } {% endfor %} + + chain PREROUTING_CT_TIMEOUT { + type filter hook prerouting priority -199; policy accept; + counter jump VYOS_CT_TIMEOUT + } + + chain OUTPUT_CT_TIMEOUT { + type filter hook output priority -199; policy accept; + counter jump VYOS_CT_TIMEOUT + } {% endif %} chain PREROUTING { type filter hook prerouting priority -300; policy accept; counter jump VYOS_CT_IGNORE - counter jump VYOS_CT_TIMEOUT counter jump FW_CONNTRACK counter jump NAT_CONNTRACK notrack @@ -147,7 +160,6 @@ table ip6 vyos_conntrack { chain OUTPUT { type filter hook output priority -300; policy accept; counter jump VYOS_CT_IGNORE - counter jump VYOS_CT_TIMEOUT counter jump FW_CONNTRACK counter jump NAT_CONNTRACK notrack |