diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2025-09-10 10:44:15 +0200 |
|---|---|---|
| committer | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2025-09-10 12:09:09 +0200 |
| commit | ae732fb0eb1dd352ba0b97b07aaf3db9c514ea19 (patch) | |
| tree | cba28059697facdf9d2463d6b970b6d5ec0e73bc /python | |
| parent | 1124d3f9aa0531489bc8f622143afcb6116e8f47 (diff) | |
| download | vyos-1x-ae732fb0eb1dd352ba0b97b07aaf3db9c514ea19.tar.gz vyos-1x-ae732fb0eb1dd352ba0b97b07aaf3db9c514ea19.zip | |
wlb: T114: Add firewall group support for WAN load balancer
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/wanloadbalance.py | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/python/vyos/wanloadbalance.py b/python/vyos/wanloadbalance.py index 158ee76c8..afe005731 100644 --- a/python/vyos/wanloadbalance.py +++ b/python/vyos/wanloadbalance.py @@ -67,6 +67,45 @@ def nft_rule(rule_conf, rule_id, local=False, exclude=False, limit=False, weight port = port[1:] output.append(f'th {prefix}port {operator} {{ {port} }}') + if 'group' in direction_conf: + group = direction_conf['group'] + if 'address_group' in group: + group_name = group['address_group'] + operator = '' + exclude = group_name[0] == "!" + if exclude: + operator = '!=' + group_name = group_name[1:] + output.append(f'ip {prefix}addr {operator} @A_{group_name}') + if 'network_group' in group: + group_name = group['network_group'] + operator = '' + if group_name[0] == "!": + operator = '!=' + group_name = group_name[1:] + output.append(f'ip {prefix}addr {operator} @N_{group_name}') + # Generate firewall group domain-group + if 'domain_group' in group: + group_name = group['domain_group'] + operator = '' + if group_name[0] == '!': + operator = '!=' + group_name = group_name[1:] + output.append(f'ip {prefix}addr {operator} @D_{group_name}') + if 'port_group' in group: + proto = rule_conf['protocol'] + group_name = group['port_group'] + + if proto == 'tcp_udp': + proto = 'th' + + operator = '' + if group_name[0] == '!': + operator = '!=' + group_name = group_name[1:] + + output.append(f'{proto} {prefix}port {operator} @P_{group_name}') + if 'source_based_routing' not in rule_conf and not restore_mark: output.append('ct state new') |