From 0d3ac22b95cef90e7c54ef823c00bb59b935c158 Mon Sep 17 00:00:00 2001 From: David Vølker Date: Mon, 1 Jun 2026 08:09:06 +0200 Subject: firewall: T8761: re-introduce VRF interface names in generated firewall config This change re-implements the intended behaviour from T4180 aswell as from T4506, it ensures that both the vrf-member interface aswell as the vrf itself is added as an oifname -> meaning that traffic traversing and originating from withing VyOS is matches outbound. Changes done by c-po: * re-sort dependency list to keep diff low * vyos.configdict.is_vrf_changed() should return early and not carry over the to-be return value * keep common coding style (dict by . separation) in nftables-zone.j2 Co-authored-by: Christian Breunig --- data/config-mode-dependencies/vyos-1x.json | 30 ++++++++++++++++++++++++++++++ data/templates/firewall/nftables-zone.j2 | 21 ++++++++++++++++++--- 2 files changed, 48 insertions(+), 3 deletions(-) (limited to 'data') diff --git a/data/config-mode-dependencies/vyos-1x.json b/data/config-mode-dependencies/vyos-1x.json index 6b9cc0e42..24118a02b 100644 --- a/data/config-mode-dependencies/vyos-1x.json +++ b/data/config-mode-dependencies/vyos-1x.json @@ -9,41 +9,71 @@ }, "interfaces_bonding": { "ethernet": ["interfaces_ethernet"], + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, "interfaces_bridge": { "vxlan": ["interfaces_vxlan"], "wlan": ["interfaces_wireless"], + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, + "interfaces_dummy": { + "firewall": ["firewall"] + }, "interfaces_ethernet": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, "interfaces_geneve": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, "interfaces_l2tpv3": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, "interfaces_macsec": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, + "interfaces_openvpn": { + "firewall": ["firewall"] + }, + "interfaces_pppoe": { + "firewall": ["firewall"] + }, "interfaces_pseudo_ethernet": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, + "interfaces_sstpc": { + "firewall": ["firewall"] + }, + "interfaces_tunnel": { + "firewall": ["firewall"] + }, "interfaces_virtual_ethernet": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, + "interfaces_vti": { + "firewall": ["firewall"] + }, "interfaces_vxlan": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, "interfaces_wireless": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, "interfaces_wwan": { + "firewall": ["firewall"], "static_arp": ["protocols_static_arp"] }, "interfaces_wireguard": { + "firewall": ["firewall"], "vxlan": ["interfaces_vxlan"] }, "load_balancing_wan": { diff --git a/data/templates/firewall/nftables-zone.j2 b/data/templates/firewall/nftables-zone.j2 index 7b4128082..45804c9d1 100644 --- a/data/templates/firewall/nftables-zone.j2 +++ b/data/templates/firewall/nftables-zone.j2 @@ -9,9 +9,14 @@ {% for zone_name, zone_conf in zone.items() %} {% if 'local_zone' not in zone_conf %} {% if 'interface' in zone_conf.member %} - oifname { {{ zone_conf.member.interface | quoted_join(',') }} } counter jump VZONE_{{ zone_name }} + oifname { {{ zone_conf.member.interface | quoted_join(",") }} } counter jump VZONE_{{ zone_name }} {% endif %} {% if 'vrf' in zone_conf.member %} +{% for vrf_name in zone_conf.member.vrf %} +{% if zone_conf.vrf_interfaces[vrf_name] | length > 0 %} + oifname { {{ zone_conf.vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump VZONE_{{ zone_name }} +{% endif %} +{% endfor %} oifname { {{ zone_conf.member.vrf | quoted_join(",") }} } counter jump VZONE_{{ zone_name }} {% endif %} {% endif %} @@ -71,6 +76,12 @@ oifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter return {% endif %} {% if 'vrf' in zone[from_zone].member %} +{% for vrf_name in zone[from_zone].member.vrf %} +{% if zone[from_zone]['vrf_interfaces'][vrf_name] | length > 0 %} + oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }} + oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter return +{% endif %} +{% endfor %} oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }} oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter return {% endif %} @@ -84,9 +95,13 @@ {% endif %} {% if 'vrf' in zone[from_zone].member %} {% for vrf_name in zone[from_zone].member.vrf %} - oifname { "{{ zone[from_zone]['vrf_interfaces'][vrf_name] }}" } counter jump NAME{{ suffix }}_{{ from_conf[fw_name] }} - oifname { "{{ zone[from_zone]['vrf_interfaces'][vrf_name] }}" } counter return +{% if zone[from_zone]['vrf_interfaces'][vrf_name] | length > 0 %} + oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf[fw_name] }} + oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter return +{% endif %} {% endfor %} + oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }} + oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter return {% endif %} {% endfor %} {% endif %} -- cgit v1.2.3