summaryrefslogtreecommitdiff
path: root/src/conf_mode/nat.py
AgeCommit message (Collapse)Author
2024-01-22firewall: T5729: T5681: T5217: backport subsystem from current branchChristian Breunig
This is a combined backport for all accumulated changes done to the firewall subsystem on the current branch.
2024-01-04T5159: nat: add option to map network and ports. Feature used for large ↵Nicolás Fort
deployments in cgnat. (#2694) (cherry picked from commit 3fc76505d0642c32a3eae9c0ce6ab3dd2ec32dbd)
2023-12-29nat: T5681: relax wording on non existing interface Warning messageChristian Breunig
Remove the word "error" from a Warning only message to not irritate the user. (cherry picked from commit 9f863a50f1ac6c81782df6c43f7df816d9e11b16)
2023-11-01T5681: Firewall,Nat and Nat66: simplified and standarize interface matcher ↵Nicolas Fort
firewal, nat and nat66. (cherry picked from commit 51abbc0f1b2ccf4785cf7f29f1fe6f4af6007ee6)
2023-10-24T5643: nat: add interface-groups to nat. Use same cli structure for ↵Nicolas Fort
interface-name|interface-group as in firewall. (cherry picked from commit 2f2c3fa22478c7ba2e116486d655e07df878cdf4)
2023-09-14T5561: nat: defining inbound|outbound interface should not be mandatory ↵Nicolas Fort
while configuring dNAT|sNAT rule (cherry picked from commit ec5437913e489f40fea6bab89a6bb5f565cd1ab7)
2023-08-23T5472: nat redirect: allow redirection without defining redirected portNicolas Fort
2023-08-09Merge pull request #2136 from jestabro/with-defaultsChristian Breunig
T5319: remove workarounds for incorrect defaults in config-mode scripts
2023-08-08Merge pull request #2119 from nicolas-fort/T5014-dnatChristian Breunig
T5014: nat: add source and destination nat options for configuring lo…
2023-08-07T5319: remove workarounds for defaults in nat.pyJohn Estabrook
2023-08-06T5195: move helpers from vyos.validate to vyos.utils packageChristian Breunig
2023-07-31Merge branch 'current' into T5014-dnatNicolás Fort
2023-07-31T5014: fix conflicts. Add code for redirection, which is causing conflicts. ↵Nicolas Fort
Change code for new syntax
2023-07-31T5014: nat: add source and destination nat options for configuring load ↵Nicolas Fort
balance within a single rule.
2023-07-19T4899: NAT Redirect: adddestination nat redirection (to local host) feature.Nicolas Fort
2023-07-15T5195: vyos.util -> vyos.utils package refactoring part #2Christian Breunig
2023-07-14T5195: vyos.util -> vyos.utils package refactoring (#2093)Christian Breunig
* T5195: move run, cmd, call, rc_cmd helper to vyos.utils.process * T5195: use read_file and write_file implementation from vyos.utils.file Changed code automatically using: find . -type f -not -path '*/\.*' -exec sed -i 's/^from vyos.util import read_file$/from vyos.utils.file import read_file/g' {} + find . -type f -not -path '*/\.*' -exec sed -i 's/^from vyos.util import write_file$/from vyos.utils.file import write_file/g' {} + * T5195: move chmod* helpers to vyos.utils.permission * T5195: use colon_separated_to_dict from vyos.utils.dict * T5195: move is_systemd_service_* to vyos.utils.process * T5195: fix boot issues with missing imports * T5195: move dict_search_* helpers to vyos.utils.dict * T5195: move network helpers to vyos.utils.network * T5195: move commit_* helpers to vyos.utils.commit * T5195: move user I/O helpers to vyos.utils.io
2022-11-03nat: T1877: T970: Add firewall groups to NATsarthurdev
2022-10-25nat: T4706: Verify translation address or port existssarthurdev
2022-10-25nat: T4764: Remove tables on NAT deletionsarthurdev
2022-09-21nat: T4605: Refactor static NAT to use python module for parsing rulessarthurdev
* Rename table to vyos_nat * Add static NAT smoketest
2022-09-21nat: T4605: Refactor NAT to use python module for parsing rulessarthurdev
* Rename table to vyos_nat * Refactor tests to use `verify_nftables` format
2022-08-31nat: T538: Move nat configs to /run directoryViacheslav Hletenko
2022-08-29nat: T4367: Move nat rules from /tmp to /run/nftables_nat.confViacheslav Hletenko
Move nftables nat configuration from /tmp to /run As we have for other services like firewall, conntrack Don't remove the config file '/run/nftables_nat.conf' after commit
2022-08-17nat: T538: Add static NAT one-to-oneViacheslav Hletenko
Ability to set static NAT (one-to-one) in one rule set nat static rule 10 destination address '203.0.113.0/24' set nat static rule 10 inbound-interface 'eth0' set nat static rule 10 translation address '192.0.2.0/24' It will be enough for PREROUTING and POSTROUTING rules Use a separate table 'vyos_static_nat' as SRC/DST rules and STATIC rules can have the same rule number
2022-05-01firewall: T4353: fix Jinja2 linting errorsChristian Poessinger
2022-04-16vyos.base: use Warning() helper where applicableChristian Poessinger
2022-04-10nat: T2199: bugfix dry-run newly generated config before installChristian Poessinger
Commit bb76e8d7f1635 ("nat: T2199: dry-run newly generated config before install") added support to verify the generated nftables ruleset. Unfortunately if the verify failed - a Python exception was triggered: NameError: name 'nftables_ct_file' is not defined This was due to bad copy/pasting.
2022-01-10nat: T2199: dry-run newly generated config before installChristian Poessinger
Before installing a new conntrack policy into the OS Kernel, the new policy should be verified by nftables if it can be loaded at all or if it will fail to load. There is no need to load a "bad" configuration if we can pre-test it.
2022-01-01nat: T2199: rename iptables -> nftables variable prefixChristian Poessinger
2021-12-06firewall: T2199: Migrate firewall to XML/Pythonsarthurdev
2021-08-18nat: T2198: remove superfluous else clause on missing outbound-interfaceChristian Poessinger
2021-01-19nat: T2947: add many-many translationChristian Poessinger
Support a 1:1 or 1:n prefix translation. The following configuration will NAT source addresses from the 10.2.0.0/16 range to an address from 192.0.2.0/29. For this feature to work a Linux Kernel 5.8 or higher is required! vyos@vyos# show nat source { rule 100 { outbound-interface eth1 source { address 10.2.0.0/16 } translation { address 192.0.2.0/29 } } } This results in the nftables configuration: chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; oifname "eth1" counter packets 0 bytes 0 snat ip prefix to ip saddr map { 10.2.0.0/16 : 192.0.2.0/29 } comment "SRC-NAT-100" }
2021-01-11nat: T3206: unable to delete only rules but keep destination nodeChristian Poessinger
2020-12-01nat: T3102: Check key in dictionaryDmitriyEshenko
2020-11-28nat: T3092: migrate to get_config_dict()Christian Poessinger
The NAT system consists out of nested tag nodes which makes manual parsing very hard. This is a perfect candidate for migrating this to get_config_dict() as there is already a smoketest in place. In addition this should make it easier to add features like static nat/hairpin.
2020-11-27vyos.template: T2720: always enable Jinja2 trim_blocks featureChristian Poessinger
2020-10-01nat: T2948: fix validation of IP address rangeChristian Poessinger
2020-08-31configd: T2582: add scripts to include list for daemonJohn Estabrook
2020-08-30nat: T2814: nftables module for NAT has been renamedChristian Poessinger
Depending on the underlaying Kernel version load the corresponding Kernel module.
2020-08-28nat: T2813: translation address is mandatory if rule is not excludedChristian Poessinger
2020-07-25vyos.util: add common helper to load kernel modulesChristian Poessinger
l2tpv3, wireguard, wirelessmodem, nat all require additional Kernel modules to be present on the system. Each and every interface implemented their own way of loading a module - by copying code. Use a generic function, vyos.util.check_kmod() to load any arbitrary kernel module passed as string or list.
2020-07-19nat: T2709: remove 'translation address' mandatory checkJernej Jakob
Rules without a translation address are also valid, they'll modify just the port and leave the address intact. This also used to be a valid syntax and it caused an error on upgrade.
2020-07-12nat: T2699: fix exclusion rules for noNAT destinationsChristian Poessinger
2020-06-11nat: T2571: fix failing negated CLI configurationsChristian Poessinger
tested using: set nat destination rule 399 description 'Redirect DNS iot VLAN' set nat destination rule 399 destination address '!192.168.67.243-192.168.67.244' set nat destination rule 399 destination port '53' set nat destination rule 399 inbound-interface bond10.204 set nat destination rule 399 log set nat destination rule 399 protocol 'tcp_udp' set nat destination rule 399 translation address '192.168.67.243' set nat destination rule 399 translation port '53' set nat destination rule 400 description 'Redirect DNS lan VLAN' set nat destination rule 400 destination address '!192.168.67.243-192.168.67.244' set nat destination rule 400 destination port '53' set nat destination rule 400 inbound-interface bond10.204 set nat destination rule 400 log set nat destination rule 400 protocol 'tcp_udp' set nat destination rule 400 translation address '192.168.67.243' set nat destination rule 400 translation port '53' set nat destination rule 401 description 'Redirect DNS guest VLAN' set nat destination rule 401 destination address '!192.168.67.243-192.168.67.244' set nat destination rule 401 destination port '53' set nat destination rule 401 inbound-interface bond10.204 set nat destination rule 401 log set nat destination rule 401 protocol 'tcp_udp' set nat destination rule 401 translation address '192.168.67.243' set nat destination rule 401 translation port '53'
2020-05-29airbag: T2088: explicit enabling of the featureThomas Mangin
airbag must now be explicitly installed. the patch also allow to fully disables the installation of the logging code at setup (and not just installing and doing nothing)
2020-05-19nat: do not report unassigned IP address for DNATChristian Poessinger
That warning made no sense as the destination address where we forward a port to is by design not locally connected.
2020-05-16nat: nptv6: T2198: add XML/Python skeletonChristian Poessinger
- define XML CLI interface - read CLI into Python dict
2020-05-16nat: T2198: add support for SNAT based on source addressesChristian Poessinger
CLI commands used for ruleset generation: set nat source rule 100 outbound-interface 'eth0.202' set nat source rule 100 protocol 'all' set nat source rule 100 source address '192.0.2.0/26' set nat source rule 100 translation address 'masquerade' set nat source rule 110 outbound-interface 'eth0.202' set nat source rule 110 protocol 'tcp' set nat source rule 110 source address '192.0.2.0/26' set nat source rule 110 source port '5556' set nat source rule 110 translation address 'masquerade'
2020-05-16nat: T2198: set default protocol to all to be backwards compatibleChristian Poessinger