diff options
| author | Adam Schultz <adam.schultz@live.com> | 2025-08-16 22:29:11 -0400 |
|---|---|---|
| committer | Adam Schultz <adam.schultz@live.com> | 2025-10-21 19:46:37 -0400 |
| commit | cc5895fe61f938189e229dffb7746fc93aac0f3b (patch) | |
| tree | 2442b47158db928c155026cb73bbfec3e438c07a /interface-definitions | |
| parent | 9e1cb14a5eb1eedd1fce67732ad84f6528e30314 (diff) | |
| download | vyos-1x-cc5895fe61f938189e229dffb7746fc93aac0f3b.tar.gz vyos-1x-cc5895fe61f938189e229dffb7746fc93aac0f3b.zip | |
firewall: T7739: Default ruleset for firewall zones
In large networks with many zones where simple allow/deny rules are not sufficient,
zones become tedious to manage. Many use cases can be simplified by providing an
ability to define a default ruleset for traffic from other zones. This change proposes
adding the follwing syntax:
set firewall zone <name> default_firewall name <name>
set firewall zone <name> default_firewall ipv6_name <name>
The proposed behavior is the following:
local in:
The default firewall ruleset for the local zone will be appended after all
from configurations.
local out:
If a non-local zone does not have a from local ruleset but does have a
default_firewall ruleset, the default_firewall ruleset will be appended using
oifname
forward:
The default firewall ruleset for the zone will be appended after all from
configurations
To keep the behavior consistent with from ruleset configurations, a return is appended
after the default_firewall ruleset.
The proposed behavior differs slightly from the default_policy configuration for the
local out chains. The default_policy applied in the out templates comes from the local
zone, not the actual outbound zone. The proposed change does not amend this, but does
make default_firewall logically consistent with the intent of the out rules.
Diffstat (limited to 'interface-definitions')
| -rw-r--r-- | interface-definitions/firewall.xml.in | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/interface-definitions/firewall.xml.in b/interface-definitions/firewall.xml.in index 7538c3cc5..d5ddbe2cd 100644 --- a/interface-definitions/firewall.xml.in +++ b/interface-definitions/firewall.xml.in @@ -428,6 +428,29 @@ </properties> <defaultValue>drop</defaultValue> </leafNode> + <node name="default-firewall"> + <properties> + <help>Default firewall rules for traffic coming into this zone</help> + </properties> + <children> + <leafNode name="ipv6-name"> + <properties> + <help>IPv6 firewall ruleset</help> + <completionHelp> + <path>firewall ipv6 name</path> + </completionHelp> + </properties> + </leafNode> + <leafNode name="name"> + <properties> + <help>IPv4 firewall ruleset</help> + <completionHelp> + <path>firewall ipv4 name</path> + </completionHelp> + </properties> + </leafNode> + </children> + </node> <tagNode name="from"> <properties> <help>Zone from which to filter traffic</help> |