diff options
| author | Daniil Baturin <daniil@vyos.io> | 2025-09-18 12:14:24 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-09-18 12:14:24 +0100 |
| commit | 119e9fedbdd10abdc6e65f8e25dff04b58c37781 (patch) | |
| tree | 859f4105ec074bc3aed6e1f39a45ec79d02a162f /python | |
| parent | 02c32914f60b4cbda4470967afe120325188bc28 (diff) | |
| parent | ae732fb0eb1dd352ba0b97b07aaf3db9c514ea19 (diff) | |
| download | vyos-1x-119e9fedbdd10abdc6e65f8e25dff04b58c37781.tar.gz vyos-1x-119e9fedbdd10abdc6e65f8e25dff04b58c37781.zip | |
Merge pull request #4708 from sarthurdev/T114
wlb: T114: Add firewall group support for WAN load balancer
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/wanloadbalance.py | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/python/vyos/wanloadbalance.py b/python/vyos/wanloadbalance.py index 158ee76c8..afe005731 100644 --- a/python/vyos/wanloadbalance.py +++ b/python/vyos/wanloadbalance.py @@ -67,6 +67,45 @@ def nft_rule(rule_conf, rule_id, local=False, exclude=False, limit=False, weight port = port[1:] output.append(f'th {prefix}port {operator} {{ {port} }}') + if 'group' in direction_conf: + group = direction_conf['group'] + if 'address_group' in group: + group_name = group['address_group'] + operator = '' + exclude = group_name[0] == "!" + if exclude: + operator = '!=' + group_name = group_name[1:] + output.append(f'ip {prefix}addr {operator} @A_{group_name}') + if 'network_group' in group: + group_name = group['network_group'] + operator = '' + if group_name[0] == "!": + operator = '!=' + group_name = group_name[1:] + output.append(f'ip {prefix}addr {operator} @N_{group_name}') + # Generate firewall group domain-group + if 'domain_group' in group: + group_name = group['domain_group'] + operator = '' + if group_name[0] == '!': + operator = '!=' + group_name = group_name[1:] + output.append(f'ip {prefix}addr {operator} @D_{group_name}') + if 'port_group' in group: + proto = rule_conf['protocol'] + group_name = group['port_group'] + + if proto == 'tcp_udp': + proto = 'th' + + operator = '' + if group_name[0] == '!': + operator = '!=' + group_name = group_name[1:] + + output.append(f'{proto} {prefix}port {operator} @P_{group_name}') + if 'source_based_routing' not in rule_conf and not restore_mark: output.append('ct state new') |