diff options
| -rw-r--r-- | docs/configuration/firewall/ipv4.md | 51 | ||||
| -rw-r--r-- | docs/configuration/firewall/ipv6.md | 51 |
2 files changed, 102 insertions, 0 deletions
diff --git a/docs/configuration/firewall/ipv4.md b/docs/configuration/firewall/ipv4.md index 35d51c4e..767a22f3 100644 --- a/docs/configuration/firewall/ipv4.md +++ b/docs/configuration/firewall/ipv4.md @@ -491,6 +491,57 @@ set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255 ::: ``` +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv4 name \<name\> rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] +``` + +```{cfgcmd} set firewall ipv4 input filter rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] +``` + +```{cfgcmd} set firewall ipv4 output filter rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] +``` + +```{cfgcmd} set firewall ipv4 name \<name\> rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] +``` + +```{cfgcmd} set firewall ipv4 prerouting raw rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] + +Match based on the result of a Forwarding Information Base (FIB) lookup +instead of the packet's literal address. `lookup` selects which address to +look up: `source-address` performs a reverse-path lookup, `destination-address` +a normal route lookup. `match route-type` compares the resulting address +type; both `lookup` and `match route-type` must be configured together. +`type` is one of `local`, `unicast`, `broadcast`, `multicast`, `anycast`, +`blackhole`, `unreachable` or `prohibit`. The `!` character negates the +match. + +This is particularly useful in `prerouting raw` to distinguish traffic +destined to the router itself from traffic being forwarded through it, +without needing to enumerate every locally configured address in a +network-group by hand: + +:::{code-block} none +set firewall ipv4 prerouting raw rule 1 fib lookup destination-address +set firewall ipv4 prerouting raw rule 1 fib match route-type local +set firewall ipv4 prerouting raw rule 1 action accept +set firewall ipv4 prerouting raw rule 2 action notrack +::: +``` + ```{cfgcmd} set firewall ipv4 forward filter rule \<1-999999\> source fqdn \<fqdn\> ``` diff --git a/docs/configuration/firewall/ipv6.md b/docs/configuration/firewall/ipv6.md index 8347511f..a705e1e0 100644 --- a/docs/configuration/firewall/ipv6.md +++ b/docs/configuration/firewall/ipv6.md @@ -492,6 +492,57 @@ set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:f ::: ``` +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv6 name \<name\> rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> fib lookup [source-address | destination-address] +``` + +```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] +``` + +```{cfgcmd} set firewall ipv6 input filter rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] +``` + +```{cfgcmd} set firewall ipv6 output filter rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] +``` + +```{cfgcmd} set firewall ipv6 name \<name\> rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] +``` + +```{cfgcmd} set firewall ipv6 prerouting raw rule \<1-999999\> fib match route-type [\<type\> | !\<type\>] + +Match based on the result of a Forwarding Information Base (FIB) lookup +instead of the packet's literal address. `lookup` selects which address to +look up: `source-address` performs a reverse-path lookup, `destination-address` +a normal route lookup. `match route-type` compares the resulting address +type; both `lookup` and `match route-type` must be configured together. +`type` is one of `local`, `unicast`, `broadcast`, `multicast`, `anycast`, +`blackhole`, `unreachable` or `prohibit`. The `!` character negates the +match. + +This is particularly useful in `prerouting raw` to distinguish traffic +destined to the router itself from traffic being forwarded through it, +without needing to enumerate every locally configured address in a +network-group by hand: + +:::{code-block} none +set firewall ipv6 prerouting raw rule 1 fib lookup destination-address +set firewall ipv6 prerouting raw rule 1 fib match route-type local +set firewall ipv6 prerouting raw rule 1 action accept +set firewall ipv6 prerouting raw rule 2 action notrack +::: +``` + ```{cfgcmd} set firewall ipv6 forward filter rule \<1-999999\> source fqdn \<fqdn\> ``` |