diff options
Diffstat (limited to 'data/templates/zone_policy/nftables6.j2')
| -rw-r--r-- | data/templates/zone_policy/nftables6.j2 | 77 |
1 files changed, 77 insertions, 0 deletions
diff --git a/data/templates/zone_policy/nftables6.j2 b/data/templates/zone_policy/nftables6.j2 new file mode 100644 index 000000000..f7123d63d --- /dev/null +++ b/data/templates/zone_policy/nftables6.j2 @@ -0,0 +1,77 @@ +#!/usr/sbin/nft -f + +{% if zone is vyos_defined %} + chain VYOS_ZONE6_FORWARD { + type filter hook forward priority -1; policy accept; +{% if state_policy is vyos_defined %} + jump VYOS_STATE_POLICY6 +{% endif %} +{% for zone_name, zone_conf in zone.items() %} +{% if zone_conf.ipv6 %} +{% if 'local_zone' not in zone_conf %} + oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE6_{{ zone_name }} +{% endif %} +{% endif %} +{% endfor %} + } + chain VYOS_ZONE6_LOCAL { + type filter hook input priority -1; policy accept; +{% if firewall.state_policy is vyos_defined %} + jump VYOS_STATE_POLICY6 +{% endif %} +{% for zone_name, zone_conf in zone.items() %} +{% if zone_conf.ipv6 %} +{% if 'local_zone' in zone_conf %} + counter jump VZONE6_{{ zone_name }}_IN +{% endif %} +{% endif %} +{% endfor %} + } + chain VYOS_ZONE6_OUTPUT { + type filter hook output priority -1; policy accept; +{% if firewall.state_policy is vyos_defined %} + jump VYOS_STATE_POLICY6 +{% endif %} +{% for zone_name, zone_conf in zone.items() %} +{% if zone_conf.ipv6 %} +{% if 'local_zone' in zone_conf %} + counter jump VZONE6_{{ zone_name }}_OUT +{% endif %} +{% endif %} +{% endfor %} + } +{% for zone_name, zone_conf in zone.items() if zone_conf.ipv6 %} +{% if zone_conf.local_zone is vyos_defined %} + chain VZONE6_{{ zone_name }}_IN { + iifname lo counter return +{% for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.ipv6_name is vyos_defined %} + iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }} + iifname { {{ zone[from_zone].interface | join(",") }} } counter return +{% endfor %} + {{ zone_conf | nft_default_rule('zone6_' + zone_name) }} + } + chain VZONE6_{{ zone_name }}_OUT { + oifname lo counter return +{% for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall.ipv6_name is vyos_defined %} + oifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }} + oifname { {{ zone[from_zone].interface | join(",") }} } counter return +{% endfor %} + {{ zone_conf | nft_default_rule('zone6_' + zone_name) }} + } +{% else %} + chain VZONE6_{{ zone_name }} { + iifname { {{ zone_conf.interface | join(",") }} } counter {{ zone_conf | nft_intra_zone_action(ipv6=True) }} +{% if zone_conf.intra_zone_filtering is vyos_defined %} + iifname { {{ zone_conf.interface | join(",") }} } counter return +{% endif %} +{% for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall.ipv6_name is vyos_defined %} +{% if zone[from_zone].local_zone is not defined %} + iifname { {{ zone[from_zone].interface | join(",") }} } counter jump NAME6_{{ from_conf.firewall.ipv6_name }} + iifname { {{ zone[from_zone].interface | join(",") }} } counter return +{% endif %} +{% endfor %} + {{ zone_conf | nft_default_rule('zone6_' + zone_name) }} + } +{% endif %} +{% endfor %} +{% endif %} |