summaryrefslogtreecommitdiff
path: root/src/conf_mode/nat.py
AgeCommit message (Collapse)Author
2021-01-11nat: T3206: unable to delete only rules but keep destination nodeChristian Poessinger
2020-12-01nat: T3102: Check key in dictionaryDmitriyEshenko
2020-11-28nat: T3092: migrate to get_config_dict()Christian Poessinger
The NAT system consists out of nested tag nodes which makes manual parsing very hard. This is a perfect candidate for migrating this to get_config_dict() as there is already a smoketest in place. In addition this should make it easier to add features like static nat/hairpin.
2020-11-27vyos.template: T2720: always enable Jinja2 trim_blocks featureChristian Poessinger
2020-10-01nat: T2948: fix validation of IP address rangeChristian Poessinger
2020-08-31configd: T2582: add scripts to include list for daemonJohn Estabrook
2020-08-30nat: T2814: nftables module for NAT has been renamedChristian Poessinger
Depending on the underlaying Kernel version load the corresponding Kernel module.
2020-08-28nat: T2813: translation address is mandatory if rule is not excludedChristian Poessinger
2020-07-25vyos.util: add common helper to load kernel modulesChristian Poessinger
l2tpv3, wireguard, wirelessmodem, nat all require additional Kernel modules to be present on the system. Each and every interface implemented their own way of loading a module - by copying code. Use a generic function, vyos.util.check_kmod() to load any arbitrary kernel module passed as string or list.
2020-07-19nat: T2709: remove 'translation address' mandatory checkJernej Jakob
Rules without a translation address are also valid, they'll modify just the port and leave the address intact. This also used to be a valid syntax and it caused an error on upgrade.
2020-07-12nat: T2699: fix exclusion rules for noNAT destinationsChristian Poessinger
2020-06-11nat: T2571: fix failing negated CLI configurationsChristian Poessinger
tested using: set nat destination rule 399 description 'Redirect DNS iot VLAN' set nat destination rule 399 destination address '!192.168.67.243-192.168.67.244' set nat destination rule 399 destination port '53' set nat destination rule 399 inbound-interface bond10.204 set nat destination rule 399 log set nat destination rule 399 protocol 'tcp_udp' set nat destination rule 399 translation address '192.168.67.243' set nat destination rule 399 translation port '53' set nat destination rule 400 description 'Redirect DNS lan VLAN' set nat destination rule 400 destination address '!192.168.67.243-192.168.67.244' set nat destination rule 400 destination port '53' set nat destination rule 400 inbound-interface bond10.204 set nat destination rule 400 log set nat destination rule 400 protocol 'tcp_udp' set nat destination rule 400 translation address '192.168.67.243' set nat destination rule 400 translation port '53' set nat destination rule 401 description 'Redirect DNS guest VLAN' set nat destination rule 401 destination address '!192.168.67.243-192.168.67.244' set nat destination rule 401 destination port '53' set nat destination rule 401 inbound-interface bond10.204 set nat destination rule 401 log set nat destination rule 401 protocol 'tcp_udp' set nat destination rule 401 translation address '192.168.67.243' set nat destination rule 401 translation port '53'
2020-05-29airbag: T2088: explicit enabling of the featureThomas Mangin
airbag must now be explicitly installed. the patch also allow to fully disables the installation of the logging code at setup (and not just installing and doing nothing)
2020-05-19nat: do not report unassigned IP address for DNATChristian Poessinger
That warning made no sense as the destination address where we forward a port to is by design not locally connected.
2020-05-16nat: nptv6: T2198: add XML/Python skeletonChristian Poessinger
- define XML CLI interface - read CLI into Python dict
2020-05-16nat: T2198: add support for SNAT based on source addressesChristian Poessinger
CLI commands used for ruleset generation: set nat source rule 100 outbound-interface 'eth0.202' set nat source rule 100 protocol 'all' set nat source rule 100 source address '192.0.2.0/26' set nat source rule 100 translation address 'masquerade' set nat source rule 110 outbound-interface 'eth0.202' set nat source rule 110 protocol 'tcp' set nat source rule 110 source address '192.0.2.0/26' set nat source rule 110 source port '5556' set nat source rule 110 translation address 'masquerade'
2020-05-16nat: T2198: set default protocol to all to be backwards compatibleChristian Poessinger
2020-05-16nat: T2198: sync generated DNAT rules with VyOS 1.2Christian Poessinger
The generated NAT rules in VyOS 1.2 are compared to the generated nftables ruleset in VyOS 1.3 this was done by converting the 1.2 iptables ruleset to nftables and then do the diff. To convert from iptables to nftables use the following command: $ iptables-save -t nat > /tmp/tmp.iptables $ iptables-restore-translate -f /tmp/tmp.iptables The following CLI options have been used for testing: set nat destination rule 10 description 'foo-10' set nat destination rule 10 destination address '1.1.1.1' set nat destination rule 10 destination port '1111' set nat destination rule 10 exclude set nat destination rule 10 inbound-interface 'eth0.202' set nat destination rule 10 log set nat destination rule 10 protocol 'tcp_udp' set nat destination rule 10 translation address '192.0.2.10' set nat destination rule 15 description 'foo-10' set nat destination rule 15 destination address '1.1.1.1' set nat destination rule 15 exclude set nat destination rule 15 inbound-interface 'eth0.202' set nat destination rule 15 log set nat destination rule 15 protocol 'tcp_udp' set nat destination rule 15 translation address '192.0.2.10' set nat destination rule 20 description 'foo-20' set nat destination rule 20 destination address '2.2.2.2' set nat destination rule 20 inbound-interface 'eth0.201' set nat destination rule 20 log set nat destination rule 20 protocol 'tcp' set nat destination rule 20 translation address '192.0.2.10'
2020-05-16nat: T2198: verify translation address for SNAT and DNATChristian Poessinger
2020-05-16nat: T2198: extend verify() for destination portsChristian Poessinger
Destination NAT configuration: destination ports can only be specified when protocol is tcp, udp or tcp_udp.
2020-05-16nat: T2198: add some basic verify() rulesChristian Poessinger
2020-05-16nat: T2198: make use of jmespath when walking nftables JSON outputChristian Poessinger
2020-05-16nat: T2198: implement deletion of NAT subsystemChristian Poessinger
2020-05-16nat: T2198: automatically determine handler numbersChristian Poessinger
When instantiating NAT it is required to isntall some nftable jump targets. The targets need to be added after a specific other target thus we need to dynamically query the handler number. This is done by get_handler() which could be moved to vyos.util at a later point in time so it can be reused for a firewall rewrite.
2020-05-16nat: T2198: move from iptables to nftablesChristian Poessinger
2020-05-16nat: T2198: migrate to common template for source/destination NATChristian Poessinger
2020-05-16nat: T2198: destination nat template for iptables-restoreChristian Poessinger
2020-05-16nat: T2198: initial XML and Python representationChristian Poessinger