Merge pull request #1546 from nicolas-fort/fwall-jump

T4699: Firewall: Add jump action in firewall ruleset

2 files changed, 10 insertions, 1 deletions

diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py
index b56caef71..f9b7222fd 100644
--- a/python/vyos/firewall.py
+++ b/python/vyos/firewall.py
@@ -326,6 +326,10 @@ def parse_rule(rule_conf, fw_name, rule_id, ip_name):
 
     if 'action' in rule_conf:
         output.append(nft_action(rule_conf['action']))
+        if 'jump' in rule_conf['action']:
+            target = rule_conf['jump_target']
+            output.append(f'NAME{def_suffix}_{target}')
+
     else:
         output.append('return')
 
diff --git a/python/vyos/template.py b/python/vyos/template.py
index 4281fb34f..0e79994f5 100644
--- a/python/vyos/template.py
+++ b/python/vyos/template.py
@@ -548,7 +548,7 @@ def nft_rule(rule_conf, fw_name, rule_id, ip_name='ip'):
     return parse_rule(rule_conf, fw_name, rule_id, ip_name)
 
 @register_filter('nft_default_rule')
-def nft_default_rule(fw_conf, fw_name):
+def nft_default_rule(fw_conf, fw_name, ipv6=False):
     output = ['counter']
     default_action = fw_conf['default_action']
 
@@ -557,6 +557,11 @@ def nft_default_rule(fw_conf, fw_name):
         output.append(f'log prefix "[{fw_name[:19]}-default-{action_suffix}]"')
 
     output.append(nft_action(default_action))
+    if 'default_jump_target' in fw_conf:
+        target = fw_conf['default_jump_target']
+        def_suffix = '6' if ipv6 else ''
+        output.append(f'NAME{def_suffix}_{target}')
+
     output.append(f'comment "{fw_name} default-action {default_action}"')
     return " ".join(output)