diff options
| -rw-r--r-- | data/templates/firewall/nftables-nat.tmpl | 9 | ||||
| -rwxr-xr-x | src/conf_mode/nat.py | 15 |
2 files changed, 12 insertions, 12 deletions
diff --git a/data/templates/firewall/nftables-nat.tmpl b/data/templates/firewall/nftables-nat.tmpl index 8108d5e0f..0c29f536b 100644 --- a/data/templates/firewall/nftables-nat.tmpl +++ b/data/templates/firewall/nftables-nat.tmpl @@ -6,7 +6,7 @@ flush table nat {% if helper_functions == 'remove' %} {# NAT if going to be disabled - remove rules and targets from nftables #} -{% set base_command = "delete rule ip raw" %} +{% set base_command = "delete rule ip raw" %} {{ base_command }} PREROUTING handle {{ pre_ct_ignore }} {{ base_command }} OUTPUT handle {{ out_ct_ignore }} {{ base_command }} PREROUTING handle {{ pre_ct_conntrack }} @@ -19,7 +19,7 @@ delete chain ip raw NAT_CONNTRACK add chain ip raw NAT_CONNTRACK add rule ip raw NAT_CONNTRACK counter accept -{% set base_command = "add rule ip raw" %} +{% set base_command = "add rule ip raw" %} {{ base_command }} PREROUTING position {{ pre_ct_ignore }} counter jump VYATTA_CT_HELPER {{ base_command }} OUTPUT position {{ out_ct_ignore }} counter jump VYATTA_CT_HELPER @@ -48,10 +48,11 @@ add rule ip raw NAT_CONNTRACK counter accept {% set comment = "DST-NAT-" + rule.number %} {% if chain == "PREROUTING" %} -{% set interface = " iifname \"" + rule.interface_in + "\"" %} +{% set interface = " iifname \"" + rule.interface_in + "\"" if rule.interface_in is defined and rule.interface_in != 'any' else '' %} {% set trns_addr = "dnat to " + rule.translation_address %} + {% elif chain == "POSTROUTING" %} -{% set interface = " oifname \"" + rule.interface_out + "\"" %} +{% set interface = " oifname \"" + rule.interface_out + "\"" if rule.interface_out is defined and rule.interface_out != 'any' else '' %} {% if rule.translation_address == 'masquerade' %} {% set trns_addr = rule.translation_address %} {% if rule.translation_port %} diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py index b0a029f2b..3dd20938a 100755 --- a/src/conf_mode/nat.py +++ b/src/conf_mode/nat.py @@ -79,7 +79,7 @@ def verify_rule(rule, err_msg): 'statically maps a whole network of addresses onto another\n' \ 'network of addresses') - if not rule['translation_address']: + if not rule['exclude'] and not rule['translation_address']: raise ConfigError(f'{err_msg} translation address not specified') @@ -228,10 +228,10 @@ def verify(nat): for rule in nat['source']: interface = rule['interface_out'] - err_msg = f"Source NAT configuration error in rule {rule['number']}:" + err_msg = f'Source NAT configuration error in rule "{rule["number"]}":' - if interface and interface not in interfaces(): - print(f'NAT configuration warning: interface {interface} does not exist on this system') + if interface and interface not in 'any' and interface not in interfaces(): + print(f'Warning: rule "{rule["number"]}" interface "{interface}" does not exist on this system') if not rule['interface_out']: raise ConfigError(f'{err_msg} outbound-interface not specified') @@ -246,10 +246,10 @@ def verify(nat): for rule in nat['destination']: interface = rule['interface_in'] - err_msg = f"Destination NAT configuration error in rule {rule['number']}:" + err_msg = f'Destination NAT configuration error in rule "{rule["number"]}":' - if interface and interface not in interfaces(): - print(f'NAT configuration warning: interface {interface} does not exist on this system') + if interface and interface not in 'any' and interface not in interfaces(): + print(f'Warning: rule "{rule["number"]}" interface "{interface}" does not exist on this system') if not rule['interface_in']: raise ConfigError(f'{err_msg} inbound-interface not specified') @@ -261,7 +261,6 @@ def verify(nat): def generate(nat): render(iptables_nat_config, 'firewall/nftables-nat.tmpl', nat, trim_blocks=True, permission=0o755) - return None def apply(nat): |