1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
|
#!/usr/sbin/nft -f
{% import 'conntrack/nftables-helpers.j2' as helper_tmpl %}
{% import 'firewall/nftables-defines.j2' as group_tmpl %}
{% if first_install is not vyos_defined %}
delete table ip vyos_conntrack
{% endif %}
table ip vyos_conntrack {
chain VYOS_CT_IGNORE {
{% if ignore.ipv4.rule is vyos_defined %}
{% for rule, rule_config in ignore.ipv4.rule.items() %}
# rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
{{ rule_config | conntrack_rule(rule, 'ignore', ipv6=False) }}
{% endfor %}
{% endif %}
return
}
chain VYOS_CT_TIMEOUT {
{% if timeout.custom.ipv4.rule is vyos_defined %}
{% for rule, rule_config in timeout.custom.ipv4.rule.items() %}
# rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
{{ rule_config | conntrack_rule(rule, 'timeout', ipv6=False) }}
{% endfor %}
{% endif %}
return
}
{% if timeout.custom.ipv4.rule is vyos_defined %}
{% for rule, rule_config in timeout.custom.ipv4.rule.items() %}
ct timeout ct-timeout-{{ rule }} {
l3proto ip;
{% for protocol, protocol_config in rule_config.protocol.items() %}
protocol {{ protocol }};
policy = { {{ protocol_config | conntrack_ct_policy() }} }
{% endfor %}
}
{% endfor %}
{% endif %}
chain PREROUTING {
type filter hook prerouting priority -300; policy accept;
counter jump VYOS_CT_IGNORE
counter jump VYOS_CT_TIMEOUT
counter jump FW_CONNTRACK
counter jump NAT_CONNTRACK
counter jump WLB_CONNTRACK
notrack
}
{% if ipv4_firewall_action == 'accept' or ipv4_nat_action == 'accept' %}
chain PREROUTING_HELPER {
type filter hook prerouting priority -5; policy accept;
counter jump VYOS_CT_HELPER
}
{% endif %}
chain OUTPUT {
type filter hook output priority -300; policy accept;
counter jump VYOS_CT_IGNORE
counter jump VYOS_CT_TIMEOUT
counter jump FW_CONNTRACK
counter jump NAT_CONNTRACK
{% if wlb_local_action %}
counter jump WLB_CONNTRACK
{% endif %}
notrack
}
{% if ipv4_firewall_action == 'accept' or ipv4_nat_action == 'accept' %}
chain OUTPUT_HELPER {
type filter hook output priority -5; policy accept;
counter jump VYOS_CT_HELPER
}
{% endif %}
{{ helper_tmpl.conntrack_helpers(module_map, modules, ipv4=True) }}
chain FW_CONNTRACK {
{{ ipv4_firewall_action }}
}
chain NAT_CONNTRACK {
{{ ipv4_nat_action }}
}
chain WLB_CONNTRACK {
{{ wlb_action }}
}
{% if firewall.group is vyos_defined %}
{{ group_tmpl.groups(firewall.group, False, True) }}
{% endif %}
}
{% if first_install is not vyos_defined %}
delete table ip6 vyos_conntrack
{% endif %}
table ip6 vyos_conntrack {
chain VYOS_CT_IGNORE {
{% if ignore.ipv6.rule is vyos_defined %}
{% for rule, rule_config in ignore.ipv6.rule.items() %}
# rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
{{ rule_config | conntrack_rule(rule, 'ignore', ipv6=True) }}
{% endfor %}
{% endif %}
return
}
chain VYOS_CT_TIMEOUT {
{% if timeout.custom.ipv6.rule is vyos_defined %}
{% for rule, rule_config in timeout.custom.ipv6.rule.items() %}
# rule-{{ rule }} {{ '- ' ~ rule_config.description if rule_config.description is vyos_defined }}
{{ rule_config | conntrack_rule(rule, 'timeout', ipv6=True) }}
{% endfor %}
{% endif %}
return
}
{% if timeout.custom.ipv6.rule is vyos_defined %}
{% for rule, rule_config in timeout.custom.ipv6.rule.items() %}
ct timeout ct-timeout-{{ rule }} {
l3proto ip;
{% for protocol, protocol_config in rule_config.protocol.items() %}
protocol {{ protocol }};
policy = { {{ protocol_config | conntrack_ct_policy() }} }
{% endfor %}
}
{% endfor %}
{% endif %}
chain PREROUTING {
type filter hook prerouting priority -300; policy accept;
counter jump VYOS_CT_IGNORE
counter jump VYOS_CT_TIMEOUT
counter jump FW_CONNTRACK
counter jump NAT_CONNTRACK
notrack
}
{% if ipv6_firewall_action == 'accept' or ipv6_nat_action == 'accept' %}
chain PREROUTING_HELPER {
type filter hook prerouting priority -5; policy accept;
counter jump VYOS_CT_HELPER
}
{% endif %}
chain OUTPUT {
type filter hook output priority -300; policy accept;
counter jump VYOS_CT_IGNORE
counter jump VYOS_CT_TIMEOUT
counter jump FW_CONNTRACK
counter jump NAT_CONNTRACK
notrack
}
{% if ipv6_firewall_action == 'accept' or ipv6_nat_action == 'accept' %}
chain OUTPUT_HELPER {
type filter hook output priority -5; policy accept;
counter jump VYOS_CT_HELPER
}
{% endif %}
{{ helper_tmpl.conntrack_helpers(module_map, modules, ipv4=False) }}
chain FW_CONNTRACK {
{{ ipv6_firewall_action }}
}
chain NAT_CONNTRACK {
{{ ipv6_nat_action }}
}
{% if firewall.group is vyos_defined %}
{{ group_tmpl.groups(firewall.group, True, True) }}
{% endif %}
}
|
