blob: 5a4e030150d111cf26e8014638deb364fdda1640 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
|
#!/usr/sbin/nft -f
# Required by wanloadbalance
table ip nat {
chain VYOS_PRE_SNAT_HOOK {
type nat hook postrouting priority 99; policy accept;
return
}
}
table inet mangle {
# Used by system flow-accounting
chain FORWARD {
type filter hook forward priority -150; policy accept;
}
}
table raw {
chain VYOS_TCP_MSS {
type filter hook forward priority -300; policy accept;
}
chain vyos_global_rpfilter {
return
}
chain vyos_rpfilter {
type filter hook prerouting priority -300; policy accept;
counter jump vyos_global_rpfilter
}
# Used by system flow-accounting
chain VYOS_PREROUTING_HOOK {
type filter hook prerouting priority -300; policy accept;
}
}
table ip6 raw {
chain VYOS_TCP_MSS {
type filter hook forward priority -300; policy accept;
}
chain vyos_global_rpfilter {
return
}
chain vyos_rpfilter {
type filter hook prerouting priority -300; policy accept;
counter jump vyos_global_rpfilter
}
# Used by system flow-accounting
chain VYOS_PREROUTING_HOOK {
type filter hook prerouting priority -300; policy accept;
}
}
# Required by VRF
table inet vrf_zones {
# Map of interfaces and connections tracking zones
map ct_iface_map {
typeof iifname : ct zone
}
# Assign unique zones for each VRF
# Chain for inbound traffic
chain vrf_zones_ct_in {
type filter hook prerouting priority raw; policy accept;
counter ct original zone set iifname map @ct_iface_map
}
# Chain for locally-generated traffic
chain vrf_zones_ct_out {
type filter hook output priority raw; policy accept;
counter ct original zone set oifname map @ct_iface_map
}
}
|
