summaryrefslogtreecommitdiff
path: root/docs
diff options
context:
space:
mode:
authorRobert Göhler <github@ghlr.de>2023-03-14 21:29:45 +0100
committerGitHub <noreply@github.com>2023-03-14 21:29:45 +0100
commite0205c67c7a7dbb30514a7429e584fe85e772030 (patch)
treed40e1aafbaa98141ecfd7047a77022a3cf0d621f /docs
parent53a33f16ad38eee6a541a54eaa156fc3965809d7 (diff)
parent3f7160d467f7d065795b8f2cf3474eb4e51b102b (diff)
downloadvyos-documentation-e0205c67c7a7dbb30514a7429e584fe85e772030.tar.gz
vyos-documentation-e0205c67c7a7dbb30514a7429e584fe85e772030.zip
Merge pull request #966 from nicolas-fort/firewall-update
Update missing matcher options in firewall and policy route: packet-l…
Diffstat (limited to 'docs')
-rw-r--r--docs/configuration/firewall/general.rst25
-rw-r--r--docs/configuration/policy/route.rst15
2 files changed, 38 insertions, 2 deletions
diff --git a/docs/configuration/firewall/general.rst b/docs/configuration/firewall/general.rst
index f2e01e03..9cd747b5 100644
--- a/docs/configuration/firewall/general.rst
+++ b/docs/configuration/firewall/general.rst
@@ -297,9 +297,9 @@ the action of the rule will be executed.
Use this command to enable the logging of the default action.
.. cfgcmd:: set firewall name <name> rule <1-999999> action [accept | drop |
- jump | reject | return]
+ jump | queue | reject | return]
.. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> action [accept |
- drop | jump | reject | return]
+ drop | jump | queue | reject | return]
This required setting defines the action of the current rule. If action
is set to ``jump``, then ``jump-target`` is also needed.
@@ -310,6 +310,20 @@ the action of the rule will be executed.
To be used only when ``action`` is set to ``jump``. Use this
command to specify jump target.
+.. cfgcmd:: set firewall name <name> rule <1-999999> queue <0-65535>
+.. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> queue <0-65535>
+
+ Use this command to set the target to use. Action queue must be defined
+ to use this setting
+
+.. cfgcmd:: set firewall name <name> rule <1-999999> queue-options
+ <bypass-fanout>
+.. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> queue-options
+ <bypass-fanout>
+
+ Options used for queue target. Action queue must be defined to use this
+ setting
+
.. cfgcmd:: set firewall name <name> rule <1-999999> description <text>
.. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> description <text>
@@ -612,6 +626,13 @@ geoip) to keep database and rules updated.
Match based on packet length criteria. Multiple values from 1 to 65535
and ranges are supported.
+.. cfgcmd:: set firewall name <name> rule <1-999999> packet-type
+ [broadcast | host | multicast | other]
+.. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> packet-type
+ [broadcast | host | multicast | other]
+
+ Match based on packet type criteria.
+
.. cfgcmd:: set firewall name <name> rule <1-999999> protocol [<text> |
<0-255> | all | tcp_udp]
.. cfgcmd:: set firewall ipv6-name <name> rule <1-999999> protocol [<text> |
diff --git a/docs/configuration/policy/route.rst b/docs/configuration/policy/route.rst
index a6330c57..1a85ffc6 100644
--- a/docs/configuration/policy/route.rst
+++ b/docs/configuration/policy/route.rst
@@ -168,6 +168,21 @@ And for ipv6:
``tcp_udp`` for tcp and udp based packets. The ``!`` negates the selected
protocol.
+.. cfgcmd:: set policy route <name> rule <n> packet-length <text>
+.. cfgcmd:: set policy route6 <name> rule <n> packet-length <text>
+.. cfgcmd:: set policy route <name> rule <n> packet-length-exclude <text>
+.. cfgcmd:: set policy route6 <name> rule <n> packet-length-exclude <text>
+
+ Match based on packet length criteria. Multiple values from 1 to 65535
+ and ranges are supported.
+
+.. cfgcmd:: set policy route <name> rule <n> packet-type [broadcast | host
+ | multicast | other]
+.. cfgcmd:: set policy route6 <name> rule <n> packet-type [broadcast | host
+ | multicast | other]
+
+ Match based on packet type criteria.
+
.. cfgcmd:: set policy route <name> rule <n> recent count <1-255>
.. cfgcmd:: set policy route6 <name> rule <n> recent count <1-255>
.. cfgcmd:: set policy route <name> rule <n> recent time <1-4294967295>