diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-17 20:54:54 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-17 20:54:54 +0200 |
| commit | 272b6e646d64651af0b5e8e726021e4fb09cd872 (patch) | |
| tree | d0b5e93b08b792da7654b5dd0e48cd9a050472ac /python | |
| parent | a189b6b7e8ee991cc0fc7d13ee90d588ea5ca15d (diff) | |
| download | vyos-1x-272b6e646d64651af0b5e8e726021e4fb09cd872.tar.gz vyos-1x-272b6e646d64651af0b5e8e726021e4fb09cd872.zip | |
wlb: T9472: make inbound-interface "any" match traffic
"inbound-interface any", offered by completion, was rendered as an
interface literally named "any" and matched no packet, so the rule never
balanced anything.
It now matches traffic entering on any interface except the WAN interfaces
themselves. Matching those as well would also restore the routing mark on
replies arriving from an ISP and send them straight back to that ISP.
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/wanloadbalance.py | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/python/vyos/wanloadbalance.py b/python/vyos/wanloadbalance.py index 05ae6b536..1dc9a8081 100644 --- a/python/vyos/wanloadbalance.py +++ b/python/vyos/wanloadbalance.py @@ -24,7 +24,13 @@ dhclient_lease = 'dhclient_{0}.lease' def nft_rule(rule_conf, rule_id, local=False, exclude=False, limit=False, weight=None, health_state=None, action=None, restore_mark=False): output = [] - if 'inbound_interface' in rule_conf: + if rule_conf.get('inbound_interface') == 'any': + # any interface but the WAN interfaces - matching replies arriving + # from an ISP would route them back to that ISP + wan_interfaces = ', '.join(f'"{ifname}"' for ifname in rule_conf.get('wan_interfaces', [])) + if wan_interfaces and not local: + output.append(f'iifname != {{ {wan_interfaces} }}') + elif 'inbound_interface' in rule_conf: ifname = rule_conf['inbound_interface'] if local and not exclude: output.append(f'oifname != "{ifname}"') |