diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-01-30 11:10:23 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-01-30 11:10:23 +0000 |
| commit | e13d901fd903f69dad4c02152ebb4ff4ad858c7c (patch) | |
| tree | 19623f23e2a6b088b066710614aead58b2af846a /data | |
| parent | e79fd8fff6de28a603bc861253f01f544dd25797 (diff) | |
| parent | a009143a62caca207fdffffcf0b490c747a87025 (diff) | |
| download | vyos-1x-e13d901fd903f69dad4c02152ebb4ff4ad858c7c.tar.gz vyos-1x-e13d901fd903f69dad4c02152ebb4ff4ad858c7c.zip | |
Merge pull request #2877 from c-po/vrf-5973
vrf: T5973: multiple bugfixes and improvements
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/firewall/nftables-vrf-zones.j2 | 17 | ||||
| -rw-r--r-- | data/vyos-firewall-init.conf | 19 |
2 files changed, 19 insertions, 17 deletions
diff --git a/data/templates/firewall/nftables-vrf-zones.j2 b/data/templates/firewall/nftables-vrf-zones.j2 deleted file mode 100644 index 3bce7312d..000000000 --- a/data/templates/firewall/nftables-vrf-zones.j2 +++ /dev/null @@ -1,17 +0,0 @@ -table inet vrf_zones { - # Map of interfaces and connections tracking zones - map ct_iface_map { - typeof iifname : ct zone - } - # Assign unique zones for each VRF - # Chain for inbound traffic - chain vrf_zones_ct_in { - type filter hook prerouting priority raw; policy accept; - counter ct original zone set iifname map @ct_iface_map - } - # Chain for locally-generated traffic - chain vrf_zones_ct_out { - type filter hook output priority raw; policy accept; - counter ct original zone set oifname map @ct_iface_map - } -} diff --git a/data/vyos-firewall-init.conf b/data/vyos-firewall-init.conf index cd7d5011f..5a4e03015 100644 --- a/data/vyos-firewall-init.conf +++ b/data/vyos-firewall-init.conf @@ -54,3 +54,22 @@ table ip6 raw { type filter hook prerouting priority -300; policy accept; } } + +# Required by VRF +table inet vrf_zones { + # Map of interfaces and connections tracking zones + map ct_iface_map { + typeof iifname : ct zone + } + # Assign unique zones for each VRF + # Chain for inbound traffic + chain vrf_zones_ct_in { + type filter hook prerouting priority raw; policy accept; + counter ct original zone set iifname map @ct_iface_map + } + # Chain for locally-generated traffic + chain vrf_zones_ct_out { + type filter hook output priority raw; policy accept; + counter ct original zone set oifname map @ct_iface_map + } +} |