diff options
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/firewall/nftables.tmpl | 10 | ||||
| -rw-r--r-- | data/templates/zone_policy/nftables.tmpl | 14 |
2 files changed, 14 insertions, 10 deletions
diff --git a/data/templates/firewall/nftables.tmpl b/data/templates/firewall/nftables.tmpl index bbb111b1f..68e83de64 100644 --- a/data/templates/firewall/nftables.tmpl +++ b/data/templates/firewall/nftables.tmpl @@ -46,11 +46,8 @@ define P_{{ group_name }} = { table ip filter { {% if first_install is defined %} - chain VYOS_FW_IN { + chain VYOS_FW_FORWARD { type filter hook forward priority 0; policy accept; - } - chain VYOS_FW_OUT { - type filter hook forward priority 1; policy accept; jump VYOS_POST_FW } chain VYOS_FW_LOCAL { @@ -104,11 +101,8 @@ table ip filter { table ip6 filter { {% if first_install is defined %} - chain VYOS_FW6_IN { + chain VYOS_FW6_FORWARD { type filter hook forward priority 0; policy accept; - } - chain VYOS_FW6_OUT { - type filter hook forward priority 1; policy accept; jump VYOS_POST_FW6 } chain VYOS_FW6_LOCAL { diff --git a/data/templates/zone_policy/nftables.tmpl b/data/templates/zone_policy/nftables.tmpl index 21230c688..fae6e8c4f 100644 --- a/data/templates/zone_policy/nftables.tmpl +++ b/data/templates/zone_policy/nftables.tmpl @@ -81,7 +81,7 @@ table ip6 filter { insert rule ip filter VYOS_FW_LOCAL counter jump VZONE_{{ zone_name }}_IN insert rule ip filter VYOS_FW_OUTPUT counter jump VZONE_{{ zone_name }}_OUT {% else %} -insert rule ip filter VYOS_FW_OUT oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE_{{ zone_name }} +insert rule ip filter VYOS_FW_FORWARD oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE_{{ zone_name }} {% endif %} {% endif %} {% if zone_conf.ipv6 %} @@ -89,9 +89,19 @@ insert rule ip filter VYOS_FW_OUT oifname { {{ zone_conf.interface | join(',') } insert rule ip6 filter VYOS_FW6_LOCAL counter jump VZONE6_{{ zone_name }}_IN insert rule ip6 filter VYOS_FW6_OUTPUT counter jump VZONE6_{{ zone_name }}_OUT {% else %} -insert rule ip6 filter VYOS_FW6_OUT oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE6_{{ zone_name }} +insert rule ip6 filter VYOS_FW6_FORWARD oifname { {{ zone_conf.interface | join(',') }} } counter jump VZONE6_{{ zone_name }} {% endif %} {% endif %} {% endfor %} +{# Ensure that state-policy rule is first in the chain #} +{% if firewall.state_policy is defined %} +{% for chain in ['VYOS_FW_FORWARD', 'VYOS_FW_OUTPUT', 'VYOS_FW_LOCAL'] %} +insert rule ip filter {{ chain }} jump VYOS_STATE_POLICY +{% endfor %} +{% for chain in ['VYOS_FW6_FORWARD', 'VYOS_FW6_OUTPUT', 'VYOS_FW6_LOCAL'] %} +insert rule ip6 filter {{ chain }} jump VYOS_STATE_POLICY6 +{% endfor %} +{% endif %} + {% endif %} |