summaryrefslogtreecommitdiff
path: root/data/templates/firewall
diff options
context:
space:
mode:
Diffstat (limited to 'data/templates/firewall')
-rw-r--r--data/templates/firewall/nftables-bridge.j26
-rw-r--r--data/templates/firewall/nftables-zone.j218
-rw-r--r--data/templates/firewall/nftables.j222
3 files changed, 26 insertions, 20 deletions
diff --git a/data/templates/firewall/nftables-bridge.j2 b/data/templates/firewall/nftables-bridge.j2
index 7f94e10d6..dec027bf9 100644
--- a/data/templates/firewall/nftables-bridge.j2
+++ b/data/templates/firewall/nftables-bridge.j2
@@ -2,9 +2,8 @@
{% set ns = namespace(sets=[]) %}
{% if bridge.forward is vyos_defined %}
{% for prior, conf in bridge.forward.items() %}
-{% set def_action = conf.default_action %}
chain VYOS_FORWARD_{{ prior }} {
- type filter hook forward priority {{ prior }}; policy {{ def_action }};
+ type filter hook forward priority {{ prior }}; policy accept;
{% if conf.rule is vyos_defined %}
{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
{{ rule_conf | nft_rule('FWD', prior, rule_id, 'bri') }}
@@ -13,6 +12,7 @@
{% endif %}
{% endfor %}
{% endif %}
+ {{ conf | nft_default_rule('FWD-filter', 'bri') }}
}
{% endfor %}
{% endif %}
@@ -28,7 +28,7 @@
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule(name_text) }}
+ {{ conf | nft_default_rule(name_text, 'bri') }}
}
{% endfor %}
{% endif %}
diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2
index 1e9351f97..beb14ff00 100644
--- a/data/templates/firewall/nftables-zone.j2
+++ b/data/templates/firewall/nftables-zone.j2
@@ -1,7 +1,13 @@
-{% macro zone_chains(zone, ipv6=False) %}
-{% set fw_name = 'ipv6_name' if ipv6 else 'name' %}
-{% set suffix = '6' if ipv6 else '' %}
+{% macro zone_chains(zone, family) %}
+{% if family == 'ipv6' %}
+{% set fw_name = 'ipv6_name' %}
+{% set suffix = '6' %}
+{% else %}
+{% set fw_name = 'name' %}
+{% set suffix = '' %}
+{% endif %}
+
chain VYOS_ZONE_FORWARD {
type filter hook forward priority 1; policy accept;
{% for zone_name, zone_conf in zone.items() %}
@@ -36,7 +42,7 @@
iifname { {{ zone[from_zone].interface | join(",") }} } counter return
{% endfor %}
{% endif %}
- {{ zone_conf | nft_default_rule('zone_' + zone_name) }}
+ {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
chain VZONE_{{ zone_name }}_OUT {
oifname lo counter return
@@ -46,7 +52,7 @@
oifname { {{ zone[from_zone].interface | join(",") }} } counter return
{% endfor %}
{% endif %}
- {{ zone_conf | nft_default_rule('zone_' + zone_name) }}
+ {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
{% else %}
chain VZONE_{{ zone_name }} {
@@ -62,7 +68,7 @@
{% endif %}
{% endfor %}
{% endif %}
- {{ zone_conf | nft_default_rule('zone_' + zone_name) }}
+ {{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
{% endif %}
{% endfor %}
diff --git a/data/templates/firewall/nftables.j2 b/data/templates/firewall/nftables.j2
index e24a9655d..63195d25f 100644
--- a/data/templates/firewall/nftables.j2
+++ b/data/templates/firewall/nftables.j2
@@ -54,7 +54,7 @@ table ip vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule('FWD-filter') }}
+ {{ conf | nft_default_rule('FWD-filter', 'ipv4') }}
}
{% endfor %}
{% endif %}
@@ -71,7 +71,7 @@ table ip vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule('INP-filter') }}
+ {{ conf | nft_default_rule('INP-filter', 'ipv4') }}
}
{% endfor %}
{% endif %}
@@ -88,7 +88,7 @@ table ip vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule('OUT-filter') }}
+ {{ conf | nft_default_rule('OUT-filter', 'ipv4') }}
}
{% endfor %}
{% endif %}
@@ -108,7 +108,7 @@ table ip vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule('PRE-filter') }}
+ {{ conf | nft_default_rule('PRE-filter', 'ipv4') }}
}
{% endfor %}
{% endif %}
@@ -124,7 +124,7 @@ table ip vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule(name_text) }}
+ {{ conf | nft_default_rule(name_text, 'ipv4') }}
}
{% endfor %}
{% endif %}
@@ -154,7 +154,7 @@ table ip vyos_filter {
{{ group_tmpl.groups(group, False, True) }}
{% if zone is vyos_defined %}
-{{ zone_tmpl.zone_chains(zone, False) }}
+{{ zone_tmpl.zone_chains(zone, 'ipv4') }}
{% endif %}
}
@@ -182,7 +182,7 @@ table ip6 vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule('FWD-filter', ipv6=True) }}
+ {{ conf | nft_default_rule('FWD-filter', 'ipv6') }}
}
{% endfor %}
{% endif %}
@@ -199,7 +199,7 @@ table ip6 vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule('INP-filter', ipv6=True) }}
+ {{ conf | nft_default_rule('INP-filter', 'ipv6') }}
}
{% endfor %}
{% endif %}
@@ -216,7 +216,7 @@ table ip6 vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule('OUT-filter', ipv6=True) }}
+ {{ conf | nft_default_rule('OUT-filter', 'ipv6') }}
}
{% endfor %}
{% endif %}
@@ -237,7 +237,7 @@ table ip6 vyos_filter {
{% endif %}
{% endfor %}
{% endif %}
- {{ conf | nft_default_rule(name_text, ipv6=True) }}
+ {{ conf | nft_default_rule(name_text, 'ipv6') }}
}
{% endfor %}
{% endif %}
@@ -266,7 +266,7 @@ table ip6 vyos_filter {
{% endif %}
{{ group_tmpl.groups(group, True, True) }}
{% if zone is vyos_defined %}
-{{ zone_tmpl.zone_chains(zone, True) }}
+{{ zone_tmpl.zone_chains(zone, 'ipv6') }}
{% endif %}
}