From cc5895fe61f938189e229dffb7746fc93aac0f3b Mon Sep 17 00:00:00 2001
From: Adam Schultz <adam.schultz@live.com>
Date: Sat, 16 Aug 2025 22:29:11 -0400
Subject: firewall: T7739: Default ruleset for firewall zones

In large networks with many zones where simple allow/deny rules are not sufficient,
zones become tedious to manage. Many use cases can be simplified by providing an
ability to define a default ruleset for traffic from other zones. This change proposes
adding the follwing syntax:
   set firewall zone <name> default_firewall name <name>
   set firewall zone <name> default_firewall ipv6_name <name>

The proposed behavior is the following:
   local in:
      The default firewall ruleset for the local zone will be appended after all
      from configurations.
   local out:
      If a non-local zone does not have a from local ruleset but does have a
      default_firewall ruleset, the default_firewall ruleset will be appended using
      oifname
   forward:
      The default firewall ruleset for the zone will be appended after all from
      configurations

To keep the behavior consistent with from ruleset configurations, a return is appended
after the default_firewall ruleset.

The proposed behavior differs slightly from the default_policy configuration for the
local out chains. The default_policy applied in the out templates comes from the local
zone, not the actual outbound zone. The proposed change does not amend this, but does
make default_firewall logically consistent with the intent of the out rules.
---
 smoketest/scripts/cli/test_firewall.py | 44 ++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

(limited to 'smoketest/scripts/cli')

diff --git a/smoketest/scripts/cli/test_firewall.py b/smoketest/scripts/cli/test_firewall.py
index f1a28a054..90179bb40 100755
--- a/smoketest/scripts/cli/test_firewall.py
+++ b/smoketest/scripts/cli/test_firewall.py
@@ -992,6 +992,50 @@ class TestFirewall(VyOSUnitTestSHIM.TestCase):
         self.verify_nftables(nftables_search, 'ip vyos_filter')
         self.verify_nftables(nftables_search_v6, 'ip6 vyos_filter')
 
+    def test_zone_with_default_firewall(self):
+        self.cli_set(['firewall', 'ipv4', 'name', 'smoketest', 'default-action', 'drop'])
+        self.cli_set(['firewall', 'ipv4', 'name', 'smoketest-default', 'default-action', 'drop'])
+        self.cli_set(['firewall', 'zone', 'smoketest-eth0', 'member', 'interface', 'eth0'])
+        self.cli_set(['firewall', 'zone', 'smoketest-eth0', 'from', 'smoketest-eth1', 'firewall', 'name', 'smoketest'])
+        self.cli_set(['firewall', 'zone', 'smoketest-eth0', 'from', 'smoketest-local', 'firewall', 'name', 'smoketest'])
+        self.cli_set(['firewall', 'zone', 'smoketest-eth0', 'default-firewall', 'name', 'smoketest-default'])
+        self.cli_set(['firewall', 'zone', 'smoketest-eth1', 'member', 'interface', 'eth1'])
+        self.cli_set(['firewall', 'zone', 'smoketest-eth1', 'default-firewall', 'name', 'smoketest-default'])
+        self.cli_set(['firewall', 'zone', 'smoketest-eth2', 'member', 'interface', 'eth2'])
+        self.cli_set(['firewall', 'zone', 'smoketest-local', 'local-zone'])
+        self.cli_set(['firewall', 'zone', 'smoketest-local', 'from', 'smoketest-eth0', 'firewall', 'name', 'smoketest'])
+        self.cli_set(['firewall', 'zone', 'smoketest-local', 'default-firewall', 'name', 'smoketest-default'])
+        self.cli_commit()
+
+        smoketest_eth0_search = [
+            ['iifname "eth1"', 'jump NAME_smoketest'],
+            ['jump NAME_smoketest-default']
+        ]
+        self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-eth0')
+        self.verify_nftables_chain(smoketest_eth0_search, 'ip vyos_filter', 'VZONE_smoketest-eth0')
+
+        smoketest_eth1_search = [
+            ['jump NAME_smoketest-default']
+        ]
+        self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-eth1')
+        self.verify_nftables_chain(smoketest_eth1_search, 'ip vyos_filter', 'VZONE_smoketest-eth1')
+
+        self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-eth2')
+
+        smoketest_local_in_search = [
+            ['iifname "eth0"', 'jump NAME_smoketest'],
+            ['jump NAME_smoketest-default'],
+        ]
+        self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-local_IN')
+        self.verify_nftables_chain(smoketest_local_in_search, 'ip vyos_filter', 'VZONE_smoketest-local_IN')
+
+        smoketest_local_out_search = [
+            ['oifname "eth0"', 'jump NAME_smoketest'],
+            ['oifname "eth1"', 'jump NAME_smoketest-default']
+        ]
+        self.verify_nftables_chain_exists('ip vyos_filter', 'VZONE_smoketest-local_OUT')
+        self.verify_nftables_chain(smoketest_local_out_search, 'ip vyos_filter', 'VZONE_smoketest-local_OUT')
+
     def test_zone_with_vrf(self):
         self.cli_set(['firewall', 'ipv4', 'name', 'ZONE1-to-LOCAL', 'default-action', 'accept'])
         self.cli_set(['firewall', 'ipv4', 'name', 'ZONE2_to_ZONE1', 'default-action', 'continue'])
-- 
cgit v1.2.3