From cc5895fe61f938189e229dffb7746fc93aac0f3b Mon Sep 17 00:00:00 2001 From: Adam Schultz Date: Sat, 16 Aug 2025 22:29:11 -0400 Subject: firewall: T7739: Default ruleset for firewall zones In large networks with many zones where simple allow/deny rules are not sufficient, zones become tedious to manage. Many use cases can be simplified by providing an ability to define a default ruleset for traffic from other zones. This change proposes adding the follwing syntax: set firewall zone default_firewall name set firewall zone default_firewall ipv6_name The proposed behavior is the following: local in: The default firewall ruleset for the local zone will be appended after all from configurations. local out: If a non-local zone does not have a from local ruleset but does have a default_firewall ruleset, the default_firewall ruleset will be appended using oifname forward: The default firewall ruleset for the zone will be appended after all from configurations To keep the behavior consistent with from ruleset configurations, a return is appended after the default_firewall ruleset. The proposed behavior differs slightly from the default_policy configuration for the local out chains. The default_policy applied in the out templates comes from the local zone, not the actual outbound zone. The proposed change does not amend this, but does make default_firewall logically consistent with the intent of the out rules. --- src/conf_mode/firewall.py | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py index 6630b811d..9a33dab15 100755 --- a/src/conf_mode/firewall.py +++ b/src/conf_mode/firewall.py @@ -153,12 +153,15 @@ def get_config(config=None): continue local_zone_conf['from_local'] = {} + local_zone_conf['default_local'] = {} for zone, zone_conf in firewall['zone'].items(): - if zone == local_zone or 'from' not in zone_conf: + if zone == local_zone: continue - if local_zone in zone_conf['from']: + if 'from' in zone_conf and local_zone in zone_conf['from']: local_zone_conf['from_local'][zone] = zone_conf['from'][local_zone] + elif 'default_firewall' in zone_conf: + local_zone_conf['default_local'][zone] = zone_conf['default_firewall'] set_dependents('conntrack', conf) @@ -626,6 +629,18 @@ def verify(firewall): if v6_name and not dict_search_args(firewall, 'ipv6', 'name', v6_name): raise ConfigError(f'Firewall ipv6-name "{v6_name}" does not exist') + if 'default_firewall' in zone_conf: + v4_name = dict_search_args(zone_conf, 'default_firewall', 'name') + if v4_name and not dict_search_args(firewall, 'ipv4', 'name', v4_name): + raise ConfigError(f'Firewall name "{v4_name}" does not exist') + + v6_name = dict_search_args(zone_conf, 'default_firewall', 'ipv6_name') + if v6_name and not dict_search_args(firewall, 'ipv6', 'name', v6_name): + raise ConfigError(f'Firewall ipv6-name "{v6_name}" does not exist') + + if not v4_name and not v6_name: + raise ConfigError('No firewall names specified for default-firewall') + return None def generate(firewall): -- cgit v1.2.3