1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
|
{% macro zone_chains(zone, ipv6=False, state_policy=False) %}
{% set fw_name = 'ipv6_name' if ipv6 else 'name' %}
{% set suffix = '6' if ipv6 else '' %}
chain VYOS_ZONE_FORWARD {
type filter hook forward priority 1; policy accept;
{% if state_policy %}
jump VYOS_STATE_POLICY{{ suffix }}
{% endif %}
{% for zone_name, zone_conf in zone.items() %}
{% if 'local_zone' not in zone_conf %}
{% if 'interface' in zone_conf.member %}
oifname { {{ zone_conf.member.interface | quoted_join(",") }} } counter jump VZONE_{{ zone_name }}
{% endif %}
{% if 'vrf' in zone_conf.member %}
{% for vrf_name in zone_conf.member.vrf %}
{% if zone_conf.vrf_interfaces[vrf_name] | length > 0 %}
oifname { {{ zone_conf.vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump VZONE_{{ zone_name }}
{% endif %}
{% endfor %}
oifname { {{ zone_conf.member.vrf | quoted_join(",") }} } counter jump VZONE_{{ zone_name }}
{% endif %}
{% endif %}
{% endfor %}
}
chain VYOS_ZONE_LOCAL {
type filter hook input priority 1; policy accept;
{% if state_policy %}
jump VYOS_STATE_POLICY{{ suffix }}
{% endif %}
{% for zone_name, zone_conf in zone.items() %}
{% if 'local_zone' in zone_conf %}
counter jump VZONE_{{ zone_name }}_IN
{% endif %}
{% endfor %}
}
chain VYOS_ZONE_OUTPUT {
type filter hook output priority 1; policy accept;
{% if state_policy %}
jump VYOS_STATE_POLICY{{ suffix }}
{% endif %}
{% for zone_name, zone_conf in zone.items() %}
{% if 'local_zone' in zone_conf %}
counter jump VZONE_{{ zone_name }}_OUT
{% endif %}
{% endfor %}
}
{% for zone_name, zone_conf in zone.items() %}
{% if zone_conf.local_zone is vyos_defined %}
chain VZONE_{{ zone_name }}_IN {
iifname lo counter return
{% if zone_conf.from is vyos_defined %}
{% for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall[fw_name] is vyos_defined %}
{% if 'interface' in zone[from_zone].member %}
iifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
iifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter return
{% endif %}
{% if 'vrf' in zone[from_zone].member %}
iifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
iifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter return
{% endif %}
{% endfor %}
{% endif %}
{% if zone_conf.default_firewall is vyos_defined and zone_conf.default_firewall[fw_name] is vyos_defined %}
counter jump NAME{{ suffix }}_{{ zone_conf.default_firewall[fw_name] }}
counter return
{% endif %}
{{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
chain VZONE_{{ zone_name }}_OUT {
oifname lo counter return
{% if zone_conf.from_local is vyos_defined %}
{% for from_zone, from_conf in zone_conf.from_local.items() if from_conf.firewall[fw_name] is vyos_defined %}
{% if 'interface' in zone[from_zone].member %}
oifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
oifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter return
{% endif %}
{% if 'vrf' in zone[from_zone].member %}
{% for vrf_name in zone[from_zone].member.vrf %}
{% if zone[from_zone]['vrf_interfaces'][vrf_name] | length > 0 %}
oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter return
{% endif %}
{% endfor %}
oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter return
{% endif %}
{% endfor %}
{% endif %}
{% if zone_conf.default_local is vyos_defined %}
{% for from_zone, from_conf in zone_conf.default_local.items() if from_conf[fw_name] is vyos_defined %}
{% if 'interface' in zone[from_zone].member %}
oifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf[fw_name] }}
oifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter return
{% endif %}
{% if 'vrf' in zone[from_zone].member %}
{% for vrf_name in zone[from_zone].member.vrf %}
{% if zone[from_zone]['vrf_interfaces'][vrf_name] | length > 0 %}
oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf[fw_name] }}
oifname { {{ zone[from_zone].vrf_interfaces[vrf_name] | quoted_join(",") }} } counter return
{% endif %}
{% endfor %}
oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
oifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter return
{% endif %}
{% endfor %}
{% endif %}
{{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
{% else %}
chain VZONE_{{ zone_name }} {
{% if 'interface' in zone_conf.member %}
iifname { {{ zone_conf.member.interface | quoted_join(",") }} } counter {{ zone_conf | nft_intra_zone_action(ipv6) }}
{% endif %}
{% if 'vrf' in zone_conf.member %}
iifname { {{ zone_conf.member.vrf | quoted_join(",") }} } counter {{ zone_conf | nft_intra_zone_action(ipv6) }}
{% endif %}
{% if zone_conf.intra_zone_filtering is vyos_defined %}
{% if 'interface' in zone_conf.member %}
iifname { {{ zone_conf.member.interface | quoted_join(",") }} } counter return
{% endif %}
{% if 'vrf' in zone_conf.member %}
iifname { {{ zone_conf.member.vrf | quoted_join(",") }} } counter return
{% endif %}
{% endif %}
{% if zone_conf.from is vyos_defined %}
{% for from_zone, from_conf in zone_conf.from.items() if from_conf.firewall[fw_name] is vyos_defined %}
{% if zone[from_zone].local_zone is not defined %}
{% if 'interface' in zone[from_zone].member %}
iifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
iifname { {{ zone[from_zone].member.interface | quoted_join(",") }} } counter return
{% endif %}
{% if 'vrf' in zone[from_zone].member %}
iifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter jump NAME{{ suffix }}_{{ from_conf.firewall[fw_name] }}
iifname { {{ zone[from_zone].member.vrf | quoted_join(",") }} } counter return
{% endif %}
{% endif %}
{% endfor %}
{% endif %}
{% if zone_conf.default_firewall is vyos_defined and zone_conf.default_firewall[fw_name] is vyos_defined %}
counter jump NAME{{ suffix }}_{{ zone_conf.default_firewall[fw_name] }}
counter return
{% endif %}
{{ zone_conf | nft_default_rule('zone_' + zone_name, family) }}
}
{% endif %}
{% endfor %}
{% endmacro %}
|
