diff options
| author | Daniil Baturin <daniil@vyos.io> | 2025-09-22 13:55:15 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-09-22 13:55:15 +0100 |
| commit | c035c4d627ed53c9744d956b7a4d9878e36020cb (patch) | |
| tree | b574a9c1c7d029d82696f55c431caa23008edaa4 /data | |
| parent | cd04de9af0a98b86937d2055505284bc4448691c (diff) | |
| parent | 61e234a74a95f68c665a21437c9ffaa8747bbc3a (diff) | |
| download | vyos-1x-c035c4d627ed53c9744d956b7a4d9878e36020cb.tar.gz vyos-1x-c035c4d627ed53c9744d956b7a4d9878e36020cb.zip | |
Merge pull request #4698 from l0crian1/fw-disable-conntrack
firewall: T7475: Add an option to disable conntrack for individual firewall chaisn
Diffstat (limited to 'data')
| -rwxr-xr-x | data/templates/firewall/nftables.j2 | 38 |
1 files changed, 38 insertions, 0 deletions
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2 index 39ef72059..f810496f9 100755 --- a/data/templates/firewall/nftables.j2 +++ b/data/templates/firewall/nftables.j2 @@ -140,6 +140,25 @@ table ip vyos_filter { {% endfor %} {% endif %} +{% if ipv4.forward.filter.disable_conntrack is vyos_defined or ipv4.input.filter.disable_conntrack is vyos_defined %} + chain VYOS_DISABLE_CONNTRACK_INP_FWD { + type filter hook prerouting priority -320; policy accept; +{% if ipv4.forward.filter.disable_conntrack is vyos_defined %} + fib daddr . iif type unicast notrack counter comment "DISABLE-CT-FWD" +{% endif %} +{% if ipv4.input.filter.disable_conntrack is vyos_defined %} + fib daddr . iif type local notrack counter comment "DISABLE-CT-INP" +{% endif %} + } +{% endif %} + +{% if ipv4.output.filter.disable_conntrack is vyos_defined %} + chain VYOS_DISABLE_CONNTRACK_OUT { + type filter hook output priority -320; policy accept; + notrack counter comment "DISABLE-CT-OUT" + } +{% endif %} + {% for set_name in ns.sets %} set RECENT_{{ set_name }} { type ipv4_addr @@ -308,6 +327,25 @@ table ip6 vyos_filter { {% endfor %} {% endif %} +{% if ipv6.forward.filter.disable_conntrack is vyos_defined or ipv6.input.filter.disable_conntrack is vyos_defined %} + chain VYOS_DISABLE_CONNTRACK_INP_FWD_V6 { + type filter hook prerouting priority -320; policy accept; +{% if ipv6.forward.filter.disable_conntrack is vyos_defined %} + fib daddr . iif type unicast notrack counter comment "DISABLE-CT-FWD-V6" +{% endif %} +{% if ipv6.input.filter.disable_conntrack is vyos_defined %} + fib daddr . iif type local notrack counter comment "DISABLE-CT-INP-V6" +{% endif %} + } +{% endif %} + +{% if ipv6.output.filter.disable_conntrack is vyos_defined %} + chain VYOS_DISABLE_CONNTRACK_OUT_V6 { + type filter hook output priority -320; policy accept; + notrack counter comment "DISABLE-CT-OUT-V6" + } +{% endif %} + {% for set_name in ns.sets %} set RECENT6_{{ set_name }} { type ipv6_addr |