summaryrefslogtreecommitdiff
path: root/interface-definitions/firewall.xml.in
AgeCommit message (Collapse)Author
2022-06-11firewall: T4299: Add support for GeoIP filteringsarthurdev
2022-06-10Merge pull request #1356 from sarthurdev/nested_groupsChristian Poessinger
firewall: T478: Add support for nesting groups
2022-06-10firewall: T478: Add support for nesting groupssarthurdev
2022-06-10Merge pull request #1355 from nicolas-fort/T4458-ipv4-ttlChristian Poessinger
Firewall:T4458: Add ttl match option in firewall
2022-06-10Firewall:T4458: Add ttl match option in firewallNicolas Fort
2022-06-10firewall: T970: Fix for Regex for domain and check empty groupViacheslav Hletenko
It can be more then 5 symbols in top-level-domain address for example '.photography' and '.accountants' Firewall group can be added without address: * set firewall group domain-group DOMAIN Check if 'address' exists in group_config
2022-06-10Merge pull request #1322 from nicolas-fort/T3907-fwall-logDaniil Baturin
Firewall: T3907: add log-level options in firewall
2022-06-07firewall: T970: domain-group should not starts with numericViacheslav Hletenko
Edit regex to check firewall-group
2022-05-28firewall: T970: Add firewall group domain-groupViacheslav Hletenko
Domain group allows to filter addresses by domain main Resolved addresses as elements are stored to named "nft set" that used in the nftables rules Also added a dynamic "resolver" systemd daemon vyos-domain-group-resolve.service which starts python script for the domain-group addresses resolving by timeout 300 sec set firewall group domain-group DOMAINS address 'example.com' set firewall group domain-group DOMAINS address 'example.org' set firewall name FOO rule 10 action 'drop' set firewall name FOO rule 10 source group domain-group 'DOMAINS' set interfaces ethernet eth0 firewall local name 'FOO' nft list table ip filter table ip filter { set DOMAINS { type ipv4_addr flags interval elements = { 192.0.2.1, 192.0.2.85, 203.0.113.55, 203.0.113.58 } } chain NAME_FOO { ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10" counter packets 0 bytes 0 return comment "FOO default-action accept" } }
2022-05-27Firewall: T3907: Revert migration script 6-to-7 and add new 7-to-8Nicolas Fort
2022-04-29xml: T4047: use full string match in the regex validatorChristian Poessinger
2022-01-30firewall: T2199: Add constraint for tagnode namessarthurdev
2022-01-21Firewall: T4186: Adding icmpv6 corrections, in corcondancy of what was done ↵Nicolas Fort
for icmp
2022-01-18firewall: T3560: Add support for MAC address groupssarthurdev
2022-01-13Firewall: T4181: Set correct description for ipv6-network-groupfett0
2022-01-11firewall: T2199: Add ipv6-range support to IPv6 address groupsarthurdev
2022-01-10firewall: validators: T2199: Improve port validationsarthurdev
2021-12-31Merge branch 'firewall' of https://github.com/sarthurdev/vyos-1x into currentChristian Poessinger
* 'firewall' of https://github.com/sarthurdev/vyos-1x: zone_policy: T3873: Implement intra-zone-filtering policy: T2199: Migrate policy route op-mode to XML/Python policy: T2199: Migrate policy route to XML/Python zone-policy: T2199: Migrate zone-policy op-mode to XML/Python zone-policy: T2199: Migrate zone-policy to XML/Python firewall: T2199: Migrate firewall op-mode to XML/Python firewall: T2199: Migrate firewall to XML/Python
2021-12-31firewall: xml: T4100: increase maximum number of rules to 999999Christian Poessinger
2021-12-06firewall: T2199: Migrate firewall to XML/Pythonsarthurdev
2021-07-02xml: provide building block for a generic description nodeChristian Poessinger
2021-05-25firewall: T3568: add XML definitions for firewallViacheslav Hletenko
Add XML for configuration mode firewall. Used for future rewriting it to Python style.