summaryrefslogtreecommitdiff
path: root/interface-definitions/include/firewall
diff options
context:
space:
mode:
authorYuxiang Zhu <vfreex@gmail.com>2023-08-26 05:28:11 +0000
committerYuxiang Zhu <vfreex@gmail.com>2023-09-09 08:16:04 +0000
commitf909c17aca4d48598d5eaee0df81bf64967902f0 (patch)
tree8641df807e45f9257f1603c0f467d5ec226c9618 /interface-definitions/include/firewall
parentf494325bfde2ba9ff708fa00a7582a5fb6182486 (diff)
downloadvyos-1x-f909c17aca4d48598d5eaee0df81bf64967902f0.tar.gz
vyos-1x-f909c17aca4d48598d5eaee0df81bf64967902f0.zip
T4502: firewall: Add software flow offload using flowtable
The following commands will enable nftables flowtable offload on interfaces eth0 eth1: ``` set firewall global-options flow-offload software interface <name> set firewall global-options flow-offload hardware interface <name> ``` Generated nftables rules: ``` table inet vyos_offload { flowtable VYOS_FLOWTABLE_software { hook ingress priority filter - 1; devices = { eth0, eth1, eth2, eth3 }; counter } chain VYOS_OFFLOAD_software { type filter hook forward priority filter - 1; policy accept; ct state { established, related } meta l4proto { tcp, udp } flow add @VYOS_FLOWTABLE_software } } ``` Use this option to count packets and bytes for each offloaded flow: ``` set system conntrack flow-accounting ``` To verify a connection is offloaded, run ``` cat /proc/net/nf_conntrack|grep OFFLOAD ``` This PR follows firewalld's implementation: https://github.com/firewalld/firewalld/blob/e748b97787d685d0ca93f58e8d4292e87d3f0da6/src/firewall/core/nftables.py#L590 A good introduction to nftables flowtable: https://thermalcircle.de/doku.php?id=blog:linux:flowtables_1_a_netfilter_nftables_fastpath
Diffstat (limited to 'interface-definitions/include/firewall')
-rw-r--r--interface-definitions/include/firewall/flow-offload.xml.i47
-rw-r--r--interface-definitions/include/firewall/global-options.xml.i1
2 files changed, 48 insertions, 0 deletions
diff --git a/interface-definitions/include/firewall/flow-offload.xml.i b/interface-definitions/include/firewall/flow-offload.xml.i
new file mode 100644
index 000000000..706836362
--- /dev/null
+++ b/interface-definitions/include/firewall/flow-offload.xml.i
@@ -0,0 +1,47 @@
+<!-- include start from firewall/flow-offload.xml.i -->
+<node name="flow-offload">
+ <properties>
+ <help>Configurable flow offload options</help>
+ </properties>
+ <children>
+ <leafNode name="disable">
+ <properties>
+ <help>Disable flow offload</help>
+ <valueless/>
+ </properties>
+ </leafNode>
+ <node name="software">
+ <properties>
+ <help>Software offload</help>
+ </properties>
+ <children>
+ <leafNode name="interface">
+ <properties>
+ <help>Interfaces to enable</help>
+ <completionHelp>
+ <script>${vyos_completion_dir}/list_interfaces</script>
+ </completionHelp>
+ <multi/>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
+ <node name="hardware">
+ <properties>
+ <help>Hardware offload</help>
+ </properties>
+ <children>
+ <leafNode name="interface">
+ <properties>
+ <help>Interfaces to enable</help>
+ <completionHelp>
+ <script>${vyos_completion_dir}/list_interfaces</script>
+ </completionHelp>
+ <multi/>
+ </properties>
+ </leafNode>
+ </children>
+ </node>
+ </children>
+</node>
+<!-- include end -->
diff --git a/interface-definitions/include/firewall/global-options.xml.i b/interface-definitions/include/firewall/global-options.xml.i
index e655cd6ac..03c07e657 100644
--- a/interface-definitions/include/firewall/global-options.xml.i
+++ b/interface-definitions/include/firewall/global-options.xml.i
@@ -271,6 +271,7 @@
</properties>
<defaultValue>disable</defaultValue>
</leafNode>
+ #include <include/firewall/flow-offload.xml.i>
</children>
</node>
<!-- include end -->