From 9d0341379184622b3da2e7e05aeeceed4bbf83e9 Mon Sep 17 00:00:00 2001 From: Daniil Baturin Date: Wed, 6 May 2026 14:08:35 +0100 Subject: Revert "Add incremental RST-to-MyST swap mechanism (circinus) (#1867)" (#1893) This reverts commit 5eb383a10ec92c65eed525bc174785a6852e997f. --- docs/configuration/container/md-index.md | 479 ----- docs/configuration/firewall/md-bridge.md | 868 -------- docs/configuration/firewall/md-flowtables.md | 189 -- docs/configuration/firewall/md-global-options.md | 259 --- docs/configuration/firewall/md-groups.md | 526 ----- docs/configuration/firewall/md-index.md | 236 --- docs/configuration/firewall/md-ipv4.md | 2099 ------------------- docs/configuration/firewall/md-ipv6.md | 2131 -------------------- docs/configuration/firewall/md-zone.md | 221 -- docs/configuration/highavailability/md-index.md | 527 ----- docs/configuration/interfaces/md-bonding.md | 753 ------- docs/configuration/interfaces/md-bridge.md | 431 ---- docs/configuration/interfaces/md-dummy.md | 87 - docs/configuration/interfaces/md-ethernet.md | 515 ----- docs/configuration/interfaces/md-geneve.md | 105 - docs/configuration/interfaces/md-index.md | 26 - docs/configuration/interfaces/md-l2tpv3.md | 170 -- docs/configuration/interfaces/md-loopback.md | 67 - docs/configuration/interfaces/md-macsec.md | 319 --- .../interfaces/md-openvpn-examples.md | 855 -------- docs/configuration/interfaces/md-openvpn.md | 614 ------ docs/configuration/interfaces/md-pppoe.md | 419 ---- .../configuration/interfaces/md-pseudo-ethernet.md | 52 - docs/configuration/interfaces/md-sstp-client.md | 170 -- docs/configuration/interfaces/md-tunnel.md | 304 --- .../interfaces/md-virtual-ethernet.md | 119 -- docs/configuration/interfaces/md-vti.md | 53 - docs/configuration/interfaces/md-vxlan.md | 373 ---- docs/configuration/interfaces/md-wireguard.md | 441 ---- docs/configuration/interfaces/md-wireless.md | 1012 ---------- docs/configuration/interfaces/md-wwan.md | 355 ---- docs/configuration/loadbalancing/md-haproxy.md | 574 ------ docs/configuration/loadbalancing/md-index.md | 16 - docs/configuration/loadbalancing/md-wan.md | 303 --- docs/configuration/md-index.md | 24 - docs/configuration/nat/md-cgnat.md | 200 -- docs/configuration/nat/md-index.md | 13 - docs/configuration/nat/md-nat44.md | 800 -------- docs/configuration/nat/md-nat64.md | 75 - docs/configuration/nat/md-nat66.md | 241 --- docs/configuration/pki/md-index.md | 583 ------ docs/configuration/policy/md-access-list.md | 70 - docs/configuration/policy/md-as-path-list.md | 29 - docs/configuration/policy/md-community-list.md | 29 - docs/configuration/policy/md-examples.md | 208 -- docs/configuration/policy/md-extcommunity-list.md | 33 - docs/configuration/policy/md-index.md | 55 - .../policy/md-large-community-list.md | 29 - docs/configuration/policy/md-local-route.md | 100 - docs/configuration/policy/md-prefix-list.md | 152 -- docs/configuration/policy/md-route-map.md | 439 ---- docs/configuration/policy/md-route.md | 424 ---- docs/configuration/protocols/md-arp.md | 55 - docs/configuration/protocols/md-babel.md | 214 -- docs/configuration/protocols/md-bfd.md | 205 -- docs/configuration/protocols/md-bgp.md | 1414 ------------- docs/configuration/protocols/md-failover.md | 123 -- docs/configuration/protocols/md-igmp-proxy.md | 79 - docs/configuration/protocols/md-index.md | 25 - docs/configuration/protocols/md-isis.md | 822 -------- docs/configuration/protocols/md-mpls.md | 285 --- docs/configuration/protocols/md-multicast.md | 31 - docs/configuration/protocols/md-openfabric.md | 242 --- docs/configuration/protocols/md-ospf.md | 1504 -------------- docs/configuration/protocols/md-pim.md | 304 --- docs/configuration/protocols/md-pim6.md | 100 - docs/configuration/protocols/md-rip.md | 294 --- docs/configuration/protocols/md-rpki.md | 210 -- docs/configuration/protocols/md-segment-routing.md | 359 ---- docs/configuration/protocols/md-static.md | 419 ---- .../protocols/md-traffic-engineering.md | 54 - docs/configuration/service/md-broadcast-relay.md | 70 - docs/configuration/service/md-config-sync.md | 164 -- docs/configuration/service/md-conntrack-sync.md | 380 ---- docs/configuration/service/md-console-server.md | 139 -- docs/configuration/service/md-dhcp-relay.md | 225 --- docs/configuration/service/md-dhcp-server.md | 1178 ----------- docs/configuration/service/md-dns.md | 582 ------ docs/configuration/service/md-eventhandler.md | 129 -- docs/configuration/service/md-https.md | 138 -- docs/configuration/service/md-index.md | 27 - docs/configuration/service/md-ipoe-server.md | 512 ----- docs/configuration/service/md-lldp.md | 154 -- docs/configuration/service/md-mdns.md | 138 -- docs/configuration/service/md-monitoring.md | 334 --- docs/configuration/service/md-ntp.md | 202 -- docs/configuration/service/md-pppoe-server.md | 753 ------- docs/configuration/service/md-router-advert.md | 121 -- docs/configuration/service/md-salt-minion.md | 51 - docs/configuration/service/md-snmp.md | 259 --- docs/configuration/service/md-ssh.md | 366 ---- docs/configuration/service/md-tftp-server.md | 78 - docs/configuration/service/md-webproxy.md | 459 ----- docs/configuration/system/md-acceleration.md | 158 -- docs/configuration/system/md-conntrack.md | 218 -- docs/configuration/system/md-console.md | 59 - docs/configuration/system/md-default-route.md | 40 - docs/configuration/system/md-flow-accounting.md | 270 --- docs/configuration/system/md-frr.md | 45 - docs/configuration/system/md-host-name.md | 70 - docs/configuration/system/md-index.md | 34 - docs/configuration/system/md-ip.md | 126 -- docs/configuration/system/md-ipv6.md | 193 -- docs/configuration/system/md-lcd.md | 46 - docs/configuration/system/md-login.md | 604 ------ docs/configuration/system/md-name-server.md | 65 - docs/configuration/system/md-option.md | 190 -- docs/configuration/system/md-proxy.md | 27 - docs/configuration/system/md-sflow.md | 66 - docs/configuration/system/md-sysctl.md | 26 - docs/configuration/system/md-syslog.md | 450 ----- docs/configuration/system/md-task-scheduler.md | 45 - docs/configuration/system/md-time-zone.md | 17 - docs/configuration/system/md-updates.md | 36 - docs/configuration/system/md-watchdog.md | 212 -- docs/configuration/trafficpolicy/md-index.md | 1403 ------------- docs/configuration/vpn/ipsec/md-index.md | 10 - docs/configuration/vpn/ipsec/md-ipsec_general.md | 442 ---- .../vpn/ipsec/md-remoteaccess_ipsec.md | 184 -- docs/configuration/vpn/ipsec/md-site2site_ipsec.md | 829 -------- .../vpn/ipsec/md-troubleshooting_ipsec.md | 310 --- docs/configuration/vpn/md-dmvpn.md | 446 ---- docs/configuration/vpn/md-index.md | 13 - docs/configuration/vpn/md-l2tp.md | 624 ------ docs/configuration/vpn/md-openconnect.md | 363 ---- docs/configuration/vpn/md-pptp.md | 594 ------ docs/configuration/vpn/md-rsa-keys.md | 116 -- docs/configuration/vpn/md-sstp.md | 698 ------- docs/configuration/vrf/md-index.md | 621 ------ 129 files changed, 42020 deletions(-) delete mode 100644 docs/configuration/container/md-index.md delete mode 100644 docs/configuration/firewall/md-bridge.md delete mode 100644 docs/configuration/firewall/md-flowtables.md delete mode 100644 docs/configuration/firewall/md-global-options.md delete mode 100644 docs/configuration/firewall/md-groups.md delete mode 100644 docs/configuration/firewall/md-index.md delete mode 100644 docs/configuration/firewall/md-ipv4.md delete mode 100644 docs/configuration/firewall/md-ipv6.md delete mode 100644 docs/configuration/firewall/md-zone.md delete mode 100644 docs/configuration/highavailability/md-index.md delete mode 100644 docs/configuration/interfaces/md-bonding.md delete mode 100644 docs/configuration/interfaces/md-bridge.md delete mode 100644 docs/configuration/interfaces/md-dummy.md delete mode 100644 docs/configuration/interfaces/md-ethernet.md delete mode 100644 docs/configuration/interfaces/md-geneve.md delete mode 100644 docs/configuration/interfaces/md-index.md delete mode 100644 docs/configuration/interfaces/md-l2tpv3.md delete mode 100644 docs/configuration/interfaces/md-loopback.md delete mode 100644 docs/configuration/interfaces/md-macsec.md delete mode 100644 docs/configuration/interfaces/md-openvpn-examples.md delete mode 100644 docs/configuration/interfaces/md-openvpn.md delete mode 100644 docs/configuration/interfaces/md-pppoe.md delete mode 100644 docs/configuration/interfaces/md-pseudo-ethernet.md delete mode 100644 docs/configuration/interfaces/md-sstp-client.md delete mode 100644 docs/configuration/interfaces/md-tunnel.md delete mode 100644 docs/configuration/interfaces/md-virtual-ethernet.md delete mode 100644 docs/configuration/interfaces/md-vti.md delete mode 100644 docs/configuration/interfaces/md-vxlan.md delete mode 100644 docs/configuration/interfaces/md-wireguard.md delete mode 100644 docs/configuration/interfaces/md-wireless.md delete mode 100644 docs/configuration/interfaces/md-wwan.md delete mode 100644 docs/configuration/loadbalancing/md-haproxy.md delete mode 100644 docs/configuration/loadbalancing/md-index.md delete mode 100644 docs/configuration/loadbalancing/md-wan.md delete mode 100644 docs/configuration/md-index.md delete mode 100644 docs/configuration/nat/md-cgnat.md delete mode 100644 docs/configuration/nat/md-index.md delete mode 100644 docs/configuration/nat/md-nat44.md delete mode 100644 docs/configuration/nat/md-nat64.md delete mode 100644 docs/configuration/nat/md-nat66.md delete mode 100644 docs/configuration/pki/md-index.md delete mode 100644 docs/configuration/policy/md-access-list.md delete mode 100644 docs/configuration/policy/md-as-path-list.md delete mode 100644 docs/configuration/policy/md-community-list.md delete mode 100644 docs/configuration/policy/md-examples.md delete mode 100644 docs/configuration/policy/md-extcommunity-list.md delete mode 100644 docs/configuration/policy/md-index.md delete mode 100644 docs/configuration/policy/md-large-community-list.md delete mode 100644 docs/configuration/policy/md-local-route.md delete mode 100644 docs/configuration/policy/md-prefix-list.md delete mode 100644 docs/configuration/policy/md-route-map.md delete mode 100644 docs/configuration/policy/md-route.md delete mode 100644 docs/configuration/protocols/md-arp.md delete mode 100644 docs/configuration/protocols/md-babel.md delete mode 100644 docs/configuration/protocols/md-bfd.md delete mode 100644 docs/configuration/protocols/md-bgp.md delete mode 100644 docs/configuration/protocols/md-failover.md delete mode 100644 docs/configuration/protocols/md-igmp-proxy.md delete mode 100644 docs/configuration/protocols/md-index.md delete mode 100644 docs/configuration/protocols/md-isis.md delete mode 100644 docs/configuration/protocols/md-mpls.md delete mode 100644 docs/configuration/protocols/md-multicast.md delete mode 100644 docs/configuration/protocols/md-openfabric.md delete mode 100644 docs/configuration/protocols/md-ospf.md delete mode 100644 docs/configuration/protocols/md-pim.md delete mode 100644 docs/configuration/protocols/md-pim6.md delete mode 100644 docs/configuration/protocols/md-rip.md delete mode 100644 docs/configuration/protocols/md-rpki.md delete mode 100644 docs/configuration/protocols/md-segment-routing.md delete mode 100644 docs/configuration/protocols/md-static.md delete mode 100644 docs/configuration/protocols/md-traffic-engineering.md delete mode 100644 docs/configuration/service/md-broadcast-relay.md delete mode 100644 docs/configuration/service/md-config-sync.md delete mode 100644 docs/configuration/service/md-conntrack-sync.md delete mode 100644 docs/configuration/service/md-console-server.md delete mode 100644 docs/configuration/service/md-dhcp-relay.md delete mode 100644 docs/configuration/service/md-dhcp-server.md delete mode 100644 docs/configuration/service/md-dns.md delete mode 100644 docs/configuration/service/md-eventhandler.md delete mode 100644 docs/configuration/service/md-https.md delete mode 100644 docs/configuration/service/md-index.md delete mode 100644 docs/configuration/service/md-ipoe-server.md delete mode 100644 docs/configuration/service/md-lldp.md delete mode 100644 docs/configuration/service/md-mdns.md delete mode 100644 docs/configuration/service/md-monitoring.md delete mode 100644 docs/configuration/service/md-ntp.md delete mode 100644 docs/configuration/service/md-pppoe-server.md delete mode 100644 docs/configuration/service/md-router-advert.md delete mode 100644 docs/configuration/service/md-salt-minion.md delete mode 100644 docs/configuration/service/md-snmp.md delete mode 100644 docs/configuration/service/md-ssh.md delete mode 100644 docs/configuration/service/md-tftp-server.md delete mode 100644 docs/configuration/service/md-webproxy.md delete mode 100644 docs/configuration/system/md-acceleration.md delete mode 100644 docs/configuration/system/md-conntrack.md delete mode 100644 docs/configuration/system/md-console.md delete mode 100644 docs/configuration/system/md-default-route.md delete mode 100644 docs/configuration/system/md-flow-accounting.md delete mode 100644 docs/configuration/system/md-frr.md delete mode 100644 docs/configuration/system/md-host-name.md delete mode 100644 docs/configuration/system/md-index.md delete mode 100644 docs/configuration/system/md-ip.md delete mode 100644 docs/configuration/system/md-ipv6.md delete mode 100644 docs/configuration/system/md-lcd.md delete mode 100644 docs/configuration/system/md-login.md delete mode 100644 docs/configuration/system/md-name-server.md delete mode 100644 docs/configuration/system/md-option.md delete mode 100644 docs/configuration/system/md-proxy.md delete mode 100644 docs/configuration/system/md-sflow.md delete mode 100644 docs/configuration/system/md-sysctl.md delete mode 100644 docs/configuration/system/md-syslog.md delete mode 100644 docs/configuration/system/md-task-scheduler.md delete mode 100644 docs/configuration/system/md-time-zone.md delete mode 100644 docs/configuration/system/md-updates.md delete mode 100644 docs/configuration/system/md-watchdog.md delete mode 100644 docs/configuration/trafficpolicy/md-index.md delete mode 100644 docs/configuration/vpn/ipsec/md-index.md delete mode 100644 docs/configuration/vpn/ipsec/md-ipsec_general.md delete mode 100644 docs/configuration/vpn/ipsec/md-remoteaccess_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/md-site2site_ipsec.md delete mode 100644 docs/configuration/vpn/ipsec/md-troubleshooting_ipsec.md delete mode 100644 docs/configuration/vpn/md-dmvpn.md delete mode 100644 docs/configuration/vpn/md-index.md delete mode 100644 docs/configuration/vpn/md-l2tp.md delete mode 100644 docs/configuration/vpn/md-openconnect.md delete mode 100644 docs/configuration/vpn/md-pptp.md delete mode 100644 docs/configuration/vpn/md-rsa-keys.md delete mode 100644 docs/configuration/vpn/md-sstp.md delete mode 100644 docs/configuration/vrf/md-index.md (limited to 'docs/configuration') diff --git a/docs/configuration/container/md-index.md b/docs/configuration/container/md-index.md deleted file mode 100644 index db46db38..00000000 --- a/docs/configuration/container/md-index.md +++ /dev/null @@ -1,479 +0,0 @@ ---- -lastproofread: '2024-07-03' ---- - -# Container - -The VyOS container implementation is based on [Podman](https://podman.io/) as -a daemonless container engine. - -## Configuration - -```{cfgcmd} set container name \ image - -Sets the image name in the hub registry - -:::{code-block} none -set container name mysql-server image mysql:8.0 -::: - -If a registry is not specified, Docker.io will be used as the container -registry unless an alternative registry is specified using -`set container registry ` or the registry is included -in the image name - -:::{code-block} none -set container name mysql-server image quay.io/mysql:8.0 -::: -``` - - -```{cfgcmd} set container name \ entrypoint \ - -Override the default entrypoint from the image for a container. -``` - - -```{cfgcmd} set container name \ command \ - -Override the default command from the image for a container. -``` - - -```{cfgcmd} set container name \ arguments \ - -Set the command arguments for a container. -``` - - -```{cfgcmd} set container name \ host-name \ - -Set the host name for a container. -``` - - -```{cfgcmd} set container name \ allow-host-pid - -The container and the host share the same process namespace. -This means that processes running on the host are visible inside the -container, and processes inside the container are visible on the host. - -The command translates to "--pid host" when the container is created. -``` - - -```{cfgcmd} set container name \ allow-host-networks - -Allow host networking in a container. The network stack of the container is -not isolated from the host and will use the host IP. - -The command translates to "--net host" when the container is created. - -:::{note} -**allow-host-networks** cannot be used with **network** -::: -``` - - -```{cfgcmd} set container name \ network \ - -Attaches user-defined network to a container. -Only one network must be specified and must already exist. -``` - - -```{cfgcmd} set container name \ network \ address \ - -Optionally set a specific static IPv4 or IPv6 address for the container. -This address must be within the named network prefix. - -:::{note} -The first IP in the container network is reserved by the -engine and cannot be used -::: -``` - - -```{cfgcmd} set container name \ name-server \ - -Optionally set a custom name server. -If a container network is used with DNS enabled, -this setting will not have any effect. -``` - - -```{cfgcmd} set container name \ description \ - -Set a container description -``` - - -```{cfgcmd} set container name \ environment \ value \ - -Add custom environment variables. -Multiple environment variables are allowed. -The following commands translate to "-e key=value" when the container -is created. - -:::{code-block} none -set container name mysql-server environment MYSQL_DATABASE value 'zabbix' -set container name mysql-server environment MYSQL_USER value 'zabbix' -set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd' -set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd' -::: -``` - - -```{cfgcmd} set container name \ port \ source \ - -``` -```{cfgcmd} set container name \ port \ destination \ -``` - -```{cfgcmd} set container name \ port \ protocol \ - -Publish a port for the container. - -:::{code-block} none -set container name zabbix-web-nginx-mysql port http source 80 -set container name zabbix-web-nginx-mysql port http destination 8080 -set container name zabbix-web-nginx-mysql port http protocol tcp -::: -``` -:::{note} -Port publishing cannot be used with **network**. For this purpose, a workaround -using destination NAT and static IP assignment for the container is available. -::: -```{cfgcmd} set container name \ volume \ source \ -``` - -```{cfgcmd} set container name \ volume \ destination \ - -Mount a volume into the container - -:::{code-block} none -set container name coredns volume 'corefile' source /config/coredns/Corefile -set container name coredns volume 'corefile' destination /etc/Corefile -::: -``` - -```{cfgcmd} set container name \ volume \ mode \ - -Volume is either mounted as rw (read-write - default) or ro (read-only) -``` - -```{cfgcmd} set container name \ tmpfs \ destination \ - -Mount a tmpfs *(ramdisk)* filesystem to the given path within the container. -``` - -```{cfgcmd} set container name \ tmpfs \ size \ - -Size in MB for tmpfs filesystem, maximum size is 64GB or 50% of the -systems total available memory. -``` - -```{cfgcmd} set container name \ uid \ -``` - -```{cfgcmd} set container name \ gid \ - -Set the User ID or Group ID of the container -``` - -```{cfgcmd} set container name \ restart [no | on-failure | always] - -Set the restart behavior of the container. - -- **no**: Do not restart containers on exit -- **on-failure**: Restart containers when they exit with a non-zero -exit code, retrying indefinitely (default) -- **always**: Restart containers when they exit, regardless of status, -retrying indefinitely -``` - -```{cfgcmd} set container name \ cpu-quota \ - -This specifies the number of CPU resources the container can use. - -Default is 0 for unlimited. -For example, 1.25 limits the container to use up to 1.25 cores -worth of CPU time. -This can be a decimal number with up to three decimal places. - -The command translates to "--cpus=\" when the container is created. -``` - -```{cfgcmd} set container name \ memory \ - -Constrain the memory available to the container. - -Default is 512 MB. Use 0 MB for unlimited memory. -``` - -```{cfgcmd} set container name \ device \ source \ -``` - -```{cfgcmd} set container name \ device \ destination \ - -Add a host device to the container. -``` - -```{cfgcmd} set container name \ capability \ - -Set container capabilities or permissions. - -- **net-admin**: Network operations (interface, firewall, routing tables) -- **net-bind-service**: Bind a socket to privileged ports -(port numbers less than 1024) -- **net-raw**: Permission to create raw network sockets -- **setpcap**: Capability sets (from bounded or inherited set) -- **sys-admin**: Administration operations (quotactl, mount, sethostname, -setdomainame) -- **sys-time**: Permission to set system clock -``` - -```{cfgcmd} set container name \ sysctl parameter \ value \ - -Set container sysctl values. - -The subset of possible parameters are: - -- Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem, -kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced -- Parameters beginning with fs.mqueue.* -- Parameters beginning with net.* (only if user-defined network is used) -``` - -```{cfgcmd} set container name \ label \ value \ - -Add metadata label for this container. -``` - -```{cfgcmd} set container name \ disable - -Disable a container. -``` - -### Container Health checks - - -By default, no health checks are run, even when defined by the image. - -```{cfgcmd} set container name \ health-check - -Default health check is run for the container if defined by the image. -``` - -```{cfgcmd} set container name \ health-check command \ - -Override the default health check command from the image for a container. -``` - -```{cfgcmd} set container name \ health-check interval \ - -Override the default health-check interval. For example: `60` -``` - -```{cfgcmd} set container name \ health-check timeout \ - -Override the default health-check timeout. For example: `10` -``` - -```{cfgcmd} set container name \ health-check retries \ - -Number of health check retries before container is considered unhealthy. For example: `1` -``` - -### Container Networks - -```{cfgcmd} set container network \ - -Creates a named container network -``` - -```{cfgcmd} set container network \ description - -A brief description what this network is all about. -``` - -```{cfgcmd} set container network \ prefix \ - -Define IPv4 and/or IPv6 prefix for a given network name. -Both IPv4 and IPv6 can be used in parallel. -``` - -```{cfgcmd} set container network \ mtu \ - -Configure {abbr}`MTU (Maximum Transmission Unit)` for a given network. It -is the size (in bytes) of the largest ethernet frame sent on this link. -``` - -```{cfgcmd} set container network \ no-name-server - -Disable Domain Name System (DNS) plugin for this network. -``` - -```{cfgcmd} set container network \ vrf \ - -Bind container network to a given VRF instance. -``` - -### Container Registry - -```{cfgcmd} set container registry \ - -Adds registry to list of unqualified-search-registries. By default, for any -image that does not include the registry in the image name, VyOS will use -docker.io and quay.io as the container registry. -``` - -```{cfgcmd} set container registry \ disable - -Disable a given container registry -``` - -```{cfgcmd} set container registry \ authentication username -``` - -```{cfgcmd} set container registry \ authentication password - -Some container registries require credentials to be used. - -Credentials can be defined here and will only be used when adding a -container image to the system. -``` - -```{cfgcmd} set container registry \ insecure - -Allow registry access over unencrypted HTTP or TLS connections with -untrusted certificates. -``` - -```{cfgcmd} set container registry \ mirror address \ -``` - -```{cfgcmd} set container registry \ mirror host-name \ -``` - -```{cfgcmd} set container registry \ mirror port \ -``` - -```{cfgcmd} set container registry \ mirror path \ - -Registry mirror, use ``(host-name|address)[:port][/path]``. - -If you have mirror http://192.168.1.1:8080 for docker.io, you can use ``docker.io/some/repo`` or run ``podman pull docker.io/some/repo`` - -:::{code-block} none -set container registry docker.io mirror address 192.168.1.1 -set container registry docker.io mirror port 8080 -set container registry docker.io insecure -::: -If http://192.168.1.1:8080 is your own registry, you can use ``192.168.1.1:8080/some/repo`` or run ``podman pull 192.168.1.1:8080/some/repo`` - -:::{code-block} none -set container registry 192.168.1.1:8080 insecure -::: -``` - -### Log Configuration - -```{cfgcmd} set container name \ log-driver [k8s-file | journald | none] - -Set the default log driver for containers. - -- **k8s-file**: Log to a plain text file in Kubernetes-style format. -- **journald**: Log to the system journal -- **none**: Disable logging for the container - -Current default is journald. - -``` - -## Operation Commands - -```{opcmd} add container image \ - -Pull a new image for container -``` -```{opcmd} show container - -Show the list of all active containers. -``` -```{opcmd} show container image - -Show the local container images. -``` -```{opcmd} show container log \ - -Show logs from a given container -``` -```{opcmd} show container network - -Show a list available container networks -``` -```{opcmd} restart container \ - -Restart a given container -``` -```{opcmd} update container image \ - -Update container image -``` -```{opcmd} delete container image \ [force] - -Delete a particular container image based on it's image ID. -You can also delete all container images at once. - -You can not delete a container image if it has more then one tag -assigned, this is why there is a `force` option to pass down to -the container image to also remove those images. -``` - -## Example Configuration - -For the sake of demonstration, [example #1 in the official documentation](https://www.zabbix.com/documentation/current/manual/installation/containers) -to the declarative VyOS CLI syntax. - -```none -set container network zabbix prefix 172.20.0.0/16 -set container network zabbix description 'Network for Zabbix component containers' - -set container name mysql-server image mysql:8.0 -set container name mysql-server network zabbix - -set container name mysql-server environment 'MYSQL_DATABASE' value 'zabbix' -set container name mysql-server environment 'MYSQL_USER' value 'zabbix' -set container name mysql-server environment 'MYSQL_PASSWORD' value 'zabbix_pwd' -set container name mysql-server environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd' - -set container name zabbix-java-gateway image zabbix/zabbix-java-gateway:alpine-5.2-latest -set container name zabbix-java-gateway network zabbix - -set container name zabbix-server-mysql image zabbix/zabbix-server-mysql:alpine-5.2-latest -set container name zabbix-server-mysql network zabbix - -set container name zabbix-server-mysql environment 'DB_SERVER_HOST' value 'mysql-server' -set container name zabbix-server-mysql environment 'MYSQL_DATABASE' value 'zabbix' -set container name zabbix-server-mysql environment 'MYSQL_USER' value 'zabbix' -set container name zabbix-server-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd' -set container name zabbix-server-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd' -set container name zabbix-server-mysql environment 'ZBX_JAVAGATEWAY' value 'zabbix-java-gateway' - -set container name zabbix-server-mysql port zabbix source 10051 -set container name zabbix-server-mysql port zabbix destination 10051 - -set container name zabbix-web-nginx-mysql image zabbix/zabbix-web-nginx-mysql:alpine-5.2-latest -set container name zabbix-web-nginx-mysql network zabbix - -set container name zabbix-web-nginx-mysql environment 'MYSQL_DATABASE' value 'zabbix' -set container name zabbix-web-nginx-mysql environment 'ZBX_SERVER_HOST' value 'zabbix-server-mysql' -set container name zabbix-web-nginx-mysql environment 'DB_SERVER_HOST' value 'mysql-server' -set container name zabbix-web-nginx-mysql environment 'MYSQL_USER' value 'zabbix' -set container name zabbix-web-nginx-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd' -set container name zabbix-web-nginx-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd' - -set container name zabbix-web-nginx-mysql port http source 80 -set container name zabbix-web-nginx-mysql port http destination 8080 -``` diff --git a/docs/configuration/firewall/md-bridge.md b/docs/configuration/firewall/md-bridge.md deleted file mode 100644 index 3ed30f78..00000000 --- a/docs/configuration/firewall/md-bridge.md +++ /dev/null @@ -1,868 +0,0 @@ ---- -lastproofread: '2026-03-28' ---- - -(firewall-configuration)= - -# Bridge Firewall Configuration - -## Overview - -Learn more about bridge firewall configuration -and related op-mode commands. - -The following commands are covered in this section: - -```{eval-rst} -.. cfgcmd:: set firewall bridge -``` - -From the main structure defined in -{doc}`Firewall Overview` -in this section you can find detailed information only for the next part -of the general structure: - -```none -- set firewall - * bridge - - forward - + filter - - input - + filter - - output - + filter - - prerouting - + filter - - name - + custom_name -``` - -Traffic that is received by the router on an interface that is a member of a -bridge is processed on the **Bridge Layer**. Before the bridge decision is -made, all packets are analyzed at **Prerouting**. First filters can be applied -here, and also rules for ignoring connection tracking system can be configured. -The relevant configuration that acts in **prerouting** is: - -> - `set firewall bridge prerouting filter ...`. - -For traffic that needs to be switched internally by the bridge, the base -chain is **forward**, and its base command for filtering is `set firewall -bridge forward filter ...`, which happens in stage 4, highlighted with red -color. - -:::{figure} /_static/images/firewall-bridge-forward.webp -::: - -For traffic destined to the router itself or that needs to be routed -(assuming a layer3 bridge is configured), the base chain is **input**, and the -base command is `set firewall bridge input filter ...` and the path is: - -:::{figure} /_static/images/firewall-bridge-input.webp -::: - -If it's not dropped, then the packet is sent to **IP Layer**, and will be -processed by the **IP Layer** firewall: IPv4 or IPv6 ruleset. Check once again -the {doc}`general packet flow diagram` if -needed. - -For traffic that originates from the bridge itself, the base chain is -**output**, and the base command is `set firewall bridge output filter -...`, and the path is: - -:::{figure} /_static/images/firewall-bridge-output.webp -::: - -Custom bridge firewall chains can be created with the command `set firewall -bridge name ...`. To use such a custom chain, a rule with action jump -and the appropriate target must be defined in a base chain. - -## Bridge Rules - -For firewall filtering, firewall rules need to be created. Each rule is -numbered, has an action to apply if the rule is matched, and the ability -to specify multiple matching criteria. Data packets go through the rules -from 1 - 999999, so order is crucial. At the first match the action of the -rule will be executed. - -### Actions - -If a rule is defined, an action must also be defined for it. This tells the -firewall what to do if all matching criteria in the rule are met. - -In firewall bridge rules, the action can be: - -> - `accept`: accept the packet. -> - `continue`: continue parsing next rule. -> - `drop`: drop the packet. -> - `jump`: jump to another custom chain. -> - `return`: Return from the current chain and continue at the next rule -> of the last chain. -> - `queue`: Enqueue packet to userspace. -> - `notrack`: ignore connection tracking system. This action is only -> available in prerouting chain. - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> action - [accept | continue | drop | jump | queue | return] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> action - [accept | continue | drop | jump | queue | return] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> action - [accept | continue | drop | jump | queue | return] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> action - [accept | continue | drop | jump | notrack | queue | return] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> action - [accept | continue | drop | jump | queue | return] - - This required setting defines the action of the current rule. If action is - set to jump, then jump-target is also needed. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - jump-target -``` - -If action is set to ``queue``, use next command to specify the queue -target. Range is also supported: - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - queue <0-65535> - - Also, if action is set to ``queue``, use next command to specify the queue - options. Possible options are ``bypass`` and ``fanout``: -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - queue-options fanout -``` - -Also, **default-action** is an action that takes place whenever a packet does -not match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name default-action - [accept | continue | drop | jump | reject | return] - - This sets the default action of the rule-set if a packet does not match - any of the rules in that chain. If default-action is set to ``jump``, then - ``default-jump-target`` is also needed. Note that for base chains, default - action can only be set to ``accept`` or ``drop``, while on custom chains - more actions are available. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name default-jump-target - - To be used only when ``default-action`` is set to ``jump``. Use this - command to specify jump target for default rule. -``` - -:::{note} -**Important note about default-actions:** -If the default action for any base chain is not defined, then the default -action is set to **accept** for that chain. For custom chains, if the -default action is not defined, then the default-action is set to **drop**. -::: - -### Firewall Logs - -You can enable logging for every firewall rule. If enabled, other log options -can be configured. - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> log - - Enable logging for the matched packet. If this configuration command is not - present, then the log is not enabled. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name default-log - - Use this command to enable the logging of the default action on - the specified chain. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] - - Define log-level. Only applicable if rule log is enabled. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - log-options group <0-65535> - - Define the log group to send messages to. Only applicable if rule log is - enabled. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - log-options snapshot-length <0-9000> - - Define length of packet payload to include in netlink message. Only - applicable if rule log is enabled and the log group is defined. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - log-options queue-threshold <0-65535> - - Define the number of packets to queue inside the kernel before sending them - to userspace. Only applicable if rule log is enabled and the log group is - defined. -``` - -### Firewall Description - -You can define a description for reference for every custom chain. - -```{eval-rst} -.. cfgcmd:: set firewall bridge name description - - Provide a rule-set description to a custom firewall chain. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> - description - - Provide a description for each rule. -``` - -### Rule Status - -By default, when you define a rule, it is enabled. In some cases, it is -useful to disable the rule instead of removing it. - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> disable - - Command for disabling a rule but keep it in the configuration. -``` - -### Matching criteria - -There are many matching criteria against which a packet can be tested. Refer -to {doc}`IPv4` and -{doc}`IPv6` matching criteria for more details. - -Since bridges operate at layer 2, both matchers for IPv4 and IPv6 are -supported in bridge firewall configuration. Same applies to firewall groups. - -Same specific matching criteria that can be used in bridge firewall are -described in this section: - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> ethernet-type - [802.1q | 802.1ad | arp | ipv4 | ipv6] - - Match based on the Ethernet type of the packet. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> vlan - ethernet-type [802.1q | 802.1ad | arp | ipv4 | ipv6] - - Match based on the Ethernet type of the packet when it is VLAN tagged. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan id - <0-4096> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan id - <0-4096> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan id - <0-4096> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan id - <0-4096> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> vlan id - <0-4096> - - Match based on VLAN identifier. Range is also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge forward filter rule <1-999999> vlan priority - <0-7> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge input filter rule <1-999999> vlan priority - <0-7> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge output filter rule <1-999999> vlan priority - <0-7> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge prerouting filter rule <1-999999> vlan priority - <0-7> -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge name rule <1-999999> vlan priority - <0-7> - - Match based on VLAN priority (Priority Code Point - PCP). Range is also - supported. -``` - -### Packet Modifications - -Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify -packets before they are sent out. This feature provides more flexibility in -packet handling. - -```{eval-rst} -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set dscp <0-63> - - Set a specific value of Differentiated Services Codepoint (DSCP). -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set mark <1-2147483647> - - Set a specific packet mark value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set tcp-mss <500-1460> - - Set the TCP-MSS (TCP maximum segment size) for the connection. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set ttl <0-255> - - Set the TTL (Time to Live) value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge [prerouting | forward | output] filter - rule <1-999999> set hop-limit <0-255> - - Set hop limit value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall bridge [forward | output] filter - rule <1-999999> set connection-mark <0-2147483647> - - Set connection mark value. - -``` - -### Use IP firewall - -By default, for switched traffic, only the rules defined under `set firewall -bridge` are applied. There are two global-options that can be configured in -order to force deeper analysis of the packet on the IP layer. These options -are: - -```{eval-rst} -.. cfgcmd:: set firewall global-options apply-to-bridged-traffic ipv4 - - This command enables the IPv4 firewall for bridged traffic. If this option - is used, packets are also parsed by rules defined in ``set firewall ipv4 - ...`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options apply-to-bridged-traffic ipv6 - - This command enables the IPv6 firewall for bridged traffic. If this option - is used, packets are also parsed by rules defined in ``set firewall ipv6 - ...`` -``` - -## Operation-mode Firewall - -### Rule-set overview - -In this section you can find all useful firewall op-mode commands. - -General commands for firewall configuration, counter and statistics: - -```{eval-rst} -.. opcmd:: show firewall -``` - -```{eval-rst} -.. opcmd:: show firewall summary -``` - -```{eval-rst} -.. opcmd:: show firewall statistics -``` - -And, to print only bridge firewall information: - -```{eval-rst} -.. opcmd:: show firewall bridge -``` - -```{eval-rst} -.. opcmd:: show firewall bridge forward filter -``` - -```{eval-rst} -.. opcmd:: show firewall bridge forward filter rule -``` - -```{eval-rst} -.. opcmd:: show firewall bridge name -``` - -```{eval-rst} -.. opcmd:: show firewall bridge name rule -``` - -### Show Firewall log - -```{eval-rst} -.. opcmd:: show log firewall -``` - -```{eval-rst} -.. opcmd:: show log firewall bridge -``` - -```{eval-rst} -.. opcmd:: show log firewall bridge forward -``` - -```{eval-rst} -.. opcmd:: show log firewall bridge forward filter -``` - -```{eval-rst} -.. opcmd:: show log firewall bridge name -``` - -```{eval-rst} -.. opcmd:: show log firewall bridge forward filter rule -``` - -```{eval-rst} -.. opcmd:: show log firewall bridge name rule - - Show the logs of all firewall; show all bridge firewall logs; show all logs - for forward hook; show all logs for forward hook and priority filter; show - all logs for particular custom chain; show logs for specific Rule-Set. -``` - -### Example - -Configuration example: - -```none -set firewall bridge forward filter default-action 'drop' -set firewall bridge forward filter default-log -set firewall bridge forward filter rule 10 action 'continue' -set firewall bridge forward filter rule 10 inbound-interface name 'eth2' -set firewall bridge forward filter rule 10 vlan id '22' -set firewall bridge forward filter rule 20 action 'drop' -set firewall bridge forward filter rule 20 inbound-interface group 'TRUNK-RIGHT' -set firewall bridge forward filter rule 20 vlan id '60' -set firewall bridge forward filter rule 30 action 'jump' -set firewall bridge forward filter rule 30 jump-target 'TEST' -set firewall bridge forward filter rule 30 outbound-interface name '!eth1' -set firewall bridge forward filter rule 35 action 'accept' -set firewall bridge forward filter rule 35 vlan id '11' -set firewall bridge forward filter rule 40 action 'continue' -set firewall bridge forward filter rule 40 destination mac-address '66:55:44:33:22:11' -set firewall bridge forward filter rule 40 source mac-address '11:22:33:44:55:66' -set firewall bridge name TEST default-action 'accept' -set firewall bridge name TEST default-log -set firewall bridge name TEST rule 10 action 'continue' -set firewall bridge name TEST rule 10 log -set firewall bridge name TEST rule 10 vlan priority '0' -``` - -And op-mode commands: - -```none -vyos@BRI:~$ show firewall bridge -Rulesets bridge Information - ---------------------------------- -bridge Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- --------------------------------------------------------------------- -10 continue all 0 0 iifname "eth2" vlan id 22 continue -20 drop all 0 0 iifname @I_TRUNK-RIGHT vlan id 60 -30 jump all 2130 170688 oifname != "eth1" jump NAME_TEST -35 accept all 2080 168616 vlan id 11 accept -40 continue all 0 0 ether daddr 66:55:44:33:22:11 ether saddr 11:22:33:44:55:66 continue -default drop all 0 0 - ---------------------------------- -bridge Firewall "name TEST" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- -------------------------------------------------- -10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue -default accept all 2130 170688 - -vyos@BRI:~$ -vyos@BRI:~$ show firewall bridge name TEST -Ruleset Information - ---------------------------------- -bridge Firewall "name TEST" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- -------------------------------------------------- -10 continue all 2130 170688 vlan pcp 0 prefix "[bri-NAM-TEST-10-C]" continue -default accept all 2130 170688 - -vyos@BRI:~$ -``` - -Inspect logs: - -```none -vyos@BRI:~$ show log firewall bridge -Dec 05 14:37:47 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 -Dec 05 14:37:48 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 -Dec 05 14:37:49 kernel: [bri-NAM-TEST-10-C]IN=eth1 OUT=eth2 ARP HTYPE=1 PTYPE=0x0800 OPCODE=1 MACSRC=50:00:00:04:00:00 IPSRC=10.11.11.101 MACDST=00:00:00:00:00:00 IPDST=10.11.11.102 -... -vyos@BRI:~$ show log firewall bridge forward filter -Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 -Dec 05 14:42:22 kernel: [bri-FWD-filter-default-D]IN=eth2 OUT=eth1 MAC=33:33:00:00:00:16:50:00:00:06:00:00:86:dd SRC=0000:0000:0000:0000:0000:0000:0000:0000 DST=ff02:0000:0000:0000:0000:0000:0000:0016 LEN=96 TC=0 HOPLIMIT=1 FLOWLBL=0 PROTO=ICMPv6 TYPE=143 CODE=0 -``` diff --git a/docs/configuration/firewall/md-flowtables.md b/docs/configuration/firewall/md-flowtables.md deleted file mode 100644 index e43dbd30..00000000 --- a/docs/configuration/firewall/md-flowtables.md +++ /dev/null @@ -1,189 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-flowtables-configuration)= - -# Flowtables Firewall Configuration - -```{include} /_include/need_improvement.txt -``` - -## Overview - -This section provides information on firewall configuration for flowtables. - -```{eval-rst} -.. cfgcmd:: set firewall flowtable ... -``` - -To learn about the general traffic flow in VyOS firewalls, -see {doc}`Firewall `. - -```none -- set firewall - * flowtable - - custom_flow_table - + ... -``` - -Flowtables let you define a fastpath through the flowtable datapath. -Flowtables support layer 3 (IPv4 and IPv6) and layer 4 (TCP and UDP) -protocols. - -:::{figure} /_static/images/firewall-flowtable-packet-flow.webp -::: - -After the first packet successfully traverses the IP forwarding path (black -circles path), you can offload subsequent packets to the flowtable through your -ruleset. You specify when to add a flow to the flowtable during forward -filtering (red circle number 6). - -When a packet finds a matching entry in the flowtable (flowtable hit), the -system transmits it to the output netdevice. This means packets bypass the -classic IP forwarding path and use the **Fast Path** (orange circles path). -As a result, you do not see these packets from any Netfilter hooks after -ingress. If no matching entry exists in the flowtable (flowtable miss), the -packet traverses the classic IP forwarding path. - -:::{note} -**Flowtable Reference:** - -::: - -## Flowtable Configuration - -To use flowtables, you need to configure the following: - -> - Create a flowtable that includes the interfaces -> that are going to be used by the flowtable. -> - Create a firewall rule. Set the action to -> `offload` and use your desired flowtable for `offload-target`. - -Creating a flow table: - -```{eval-rst} -.. cfgcmd:: set firewall flowtable interface - - Specify interfaces to use in the flowtable. -``` - -```{eval-rst} -.. cfgcmd:: set firewall flowtable description -``` - -Provide a description for the flow table. - -```{eval-rst} -.. cfgcmd:: set firewall flowtable offload - - - Specify the offload type the flowtable uses: ``hardware`` or - ``software``. The default is ``software`` offload. -``` - -:::{note} -**Hardware offload**: Make sure your network interface controller -(NIC) supports hardware offloading and that you have the necessary drivers - -> installed before enabling this option. -::: - -Creating rules for using flow tables: - -```{eval-rst} -.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999> - action offload - - Create a firewall rule in the forward chain with the action set to - ``offload``. -``` - -```{eval-rst} -.. cfgcmd:: set firewall [ipv4 | ipv6] forward filter rule <1-999999> - offload-target - - Create a firewall rule in the forward chain and specify which flowtable - to use. Only applicable if the action is ``offload``. -``` - -## Configuration Example - -Consider the following in this setup: - -> - This example uses two interfaces in the flowtables: `eth0` and `eth1`. -> - The example provides a minimal firewall ruleset with filtering rules -> and rules for using flowtable offload capabilities. - -The first packet is evaluated by the firewall path, so a -desired connection should be explicitly accepted. -The same should occur for traffic in reverse order. -In most cases, state policies are -used to accept a connection in the reverse path. - -In the following example only traffic coming from interface `eth0`, -TCP protocol, and destination port 1122 is accepted. -All other traffic to the router is dropped. - -### Commands - -```none -set firewall flowtable FT01 interface 'eth0' -set firewall flowtable FT01 interface 'eth1' -set firewall ipv4 forward filter default-action 'drop' -set firewall ipv4 forward filter rule 10 action 'offload' -set firewall ipv4 forward filter rule 10 offload-target 'FT01' -set firewall ipv4 forward filter rule 10 state 'established' -set firewall ipv4 forward filter rule 10 state 'related' -set firewall ipv4 forward filter rule 20 action 'accept' -set firewall ipv4 forward filter rule 20 state 'established' -set firewall ipv4 forward filter rule 20 state 'related' -set firewall ipv4 forward filter rule 110 action 'accept' -set firewall ipv4 forward filter rule 110 destination address '192.0.2.100' -set firewall ipv4 forward filter rule 110 destination port '1122' -set firewall ipv4 forward filter rule 110 inbound-interface name 'eth0' -set firewall ipv4 forward filter rule 110 protocol 'tcp' -``` - -### Explanation - -Here's what happens for a desired connection: - -> 1. A packet arrives on `eth0` with destination address `192.0.2.100`, TCP -> protocol, and destination port 1122. Assume this address is reachable -> through interface `eth1`. -> 2. For this first packet, the connection state is **new**. Neither rule 10 -> nor rule 20 applies. -> 3. Rule 110 matches, so the connection is accepted. -> 4. When the server 192.0.2.100 replies, the connection state becomes -> **established**, and rule 20 accepts the reply. -> 5. The router receives the second packet for this connection. Because the -> connection state is **established**, rule 10 matches and adds a new -> entry in the flowtable FT01 for this connection. -> 6. Subsequent packets skip the traditional path and use the **Fast Path** -> for offloading. - -### Checks - -Check the conntrack table to verify that the system accepted and properly -offloaded connections. - -```none -vyos@FlowTables:~$ show firewall ipv4 forward filter -Ruleset Information - ---------------------------------- -ipv4 Firewall "forward filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------------------------------- -10 offload all 8 468 ct state { established, related } flow add @VYOS_FLOWTABLE_FT01 -20 accept all 8 468 ct state { established, related } accept -110 accept tcp 2 120 ip daddr 192.0.2.100 tcp dport 1122 iifname "eth0" accept -default drop all 7 420 - -vyos@FlowTables:~$ sudo conntrack -L | grep tcp -conntrack v1.4.6 (conntrack-tools): 5 flow entries have been shown. -tcp 6 src=198.51.100.100 dst=192.0.2.100 sport=41676 dport=1122 src=192.0.2.100 dst=198.51.100.100 sport=1122 dport=41676 [OFFLOAD] mark=0 use=2 -vyos@FlowTables:~$ -``` diff --git a/docs/configuration/firewall/md-global-options.md b/docs/configuration/firewall/md-global-options.md deleted file mode 100644 index 5a74266c..00000000 --- a/docs/configuration/firewall/md-global-options.md +++ /dev/null @@ -1,259 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-global-options-configuration)= - -# Global Options Firewall Configuration - -## Overview - -Some firewall settings are global and affect the entire system. This section -provides information about these global options that you can configure using -the VyOS CLI. - -Configuration commands covered in this section: - -```{eval-rst} -.. cfgcmd:: set firewall global-options ... -``` - -## Configuration - -```{eval-rst} -.. cfgcmd:: set firewall global-options all-ping [enable | disable] - - By default, when VyOS receives an ICMP echo request packet destined for - itself, it answers with an ICMP echo reply, unless your firewall prevents - it. - - You can set firewall rules to accept, drop, or reject ICMP in, out, or - local traffic. You can also use the **firewall global-options all-ping** - command. This command affects only LOCAL traffic (packets destined for your - VyOS system), not IN or OUT traffic. - - .. note:: **firewall global-options all-ping** affects only LOCAL traffic - and always behaves in the most restrictive way - - .. code-block:: none - - set firewall global-options all-ping enable - - When you set this command, VyOS answers every ICMP echo request addressed - to itself, but that response occurs only if no other rule drops or rejects - local echo requests. In case of conflict, VyOS does not answer ICMP echo - requests. - - .. code-block:: none - - set firewall global-options all-ping disable - - When you set this command, VyOS answers no ICMP echo requests addressed to - itself, regardless of where they come from or what specific rules accept - them. -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options apply-to-bridged-traffic [ipv4 | ipv6] - - Apply IPv4 or IPv6 firewall rules to bridged traffic. -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options broadcast-ping [enable | disable] - - Enable or disable the response to ICMP broadcast messages. The system - alters the following parameter: - - * ``net.ipv4.icmp_echo_ignore_broadcasts`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options ip-src-route [enable | disable] -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options ipv6-src-route [enable | disable] - - Set whether VyOS accepts packets with a source route option. - The following sysctl parameters will be changed: - - * ``net.ipv4.conf.all.accept_source_route`` - * ``net.ipv6.conf.all.accept_source_route`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options receive-redirects [enable | disable] -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options ipv6-receive-redirects - [enable | disable] - - Allow VyOS to accept ICMPv4 and ICMPv6 redirect messages. - The following sysctl parameters will be changed: - - * ``net.ipv4.conf.all.accept_redirects`` - * ``net.ipv6.conf.all.accept_redirects`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options send-redirects [enable | disable] - - Allow VyOS to send ICMPv4 redirect messages. - The following sysctl parameter will be changed: - - * ``net.ipv4.conf.all.send_redirects`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options log-martians [enable | disable] - - Allow VyOS to log martian IPv4 packets. - The following sysctl parameter will be changed: - - * ``net.ipv4.conf.all.log_martians`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options source-validation - [strict | loose | disable] - - Set the IPv4 source validation mode. - The following sysctl parameter will be changed: - - * ``net.ipv4.conf.all.rp_filter`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options syn-cookies [enable | disable] - - Allow VyOS to use IPv4 TCP SYN Cookies. - The following sysctl parameter will be changed: - - * ``net.ipv4.tcp_syncookies`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options twa-hazards-protection - [enable | disable] - - Enable or disable VyOS {rfc}`1337` conformance. - The following sysctl parameter will be changed: - - * ``net.ipv4.tcp_rfc1337`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy established action - [accept | drop | reject] -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy established log -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy established log-level - [emerg | alert | crit | err | warn | notice | info | debug] - - Set the global setting for an established connection. -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy invalid action - [accept | drop | reject] -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy invalid log -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy invalid log-level - [emerg | alert | crit | err | warn | notice | info | debug] - - Set the global setting for invalid packets. -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy related action - [accept | drop | reject] -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy related log -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options state-policy related log-level - [emerg | alert | crit | err | warn | notice | info | debug] - - Set the global setting for related connections. -``` - -VyOS supports setting timeouts for connections by connection type. You can -set timeout values for generic connections, ICMP connections, UDP -connections, or TCP connections in various states. - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout icmp <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout other <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout tcp close <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout tcp close-wait <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout tcp established <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout tcp fin-wait <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout tcp last-ack <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout tcp syn-recv <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout tcp syn-sent <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout tcp time-wait <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout udp other <1-21474836> - :defaultvalue: -``` - -```{eval-rst} -.. cfgcmd:: set firewall global-options timeout udp stream <1-21474836> - :defaultvalue: - - Set the timeout in seconds for a protocol or state. -``` diff --git a/docs/configuration/firewall/md-groups.md b/docs/configuration/firewall/md-groups.md deleted file mode 100644 index ed02d249..00000000 --- a/docs/configuration/firewall/md-groups.md +++ /dev/null @@ -1,526 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-groups-configuration)= - -# Firewall groups - -## Configuration - -Firewall groups represent collections of IP addresses, networks, ports, -MAC addresses, domains, or interfaces. You can reference a group in firewall, -NAT, and policy route rules as either a source or destination matcher, and/or -as inbound or outbound in the case of interface groups. - -### Address Groups - -An **address group** contains a single IP address or IP address range. - -```{eval-rst} -.. cfgcmd:: set firewall group address-group address [address | - address range] -``` - -```{eval-rst} -.. cfgcmd:: set firewall group ipv6-address-group address
- - Define an IPv4 or IPv6 address group. - - .. code-block:: none - - set firewall group address-group ADR-INSIDE-v4 address 192.168.0.1 - set firewall group address-group ADR-INSIDE-v4 address 10.0.0.1-10.0.0.8 - set firewall group ipv6-address-group ADR-INSIDE-v6 address 2001:db8::1 -``` - -```{eval-rst} -.. cfgcmd:: set firewall group address-group description -``` - -```{eval-rst} -.. cfgcmd:: set firewall group ipv6-address-group description - - Provide an IPv4 or IPv6 address group description. -``` - -### Remote Groups - -A **remote-group** uses a URL that hosts a newline-delimited list of IPv4 -and/or IPv6 addresses, CIDRs, and ranges. VyOS pulls this list periodically -according to the frequency you define in the firewall **resolver-interval** -and loads matching entries into the group for use in rules. The list is cached -in persistent storage, so rules continue to function if updates fail. - -```{eval-rst} -.. cfgcmd:: set firewall group remote-group url - - Specify a remote list of IPv4 and/or IPv6 addresses, ranges, and CIDRs - to fetch. -``` - -```{eval-rst} -.. cfgcmd:: set firewall group remote-group description - - Set a description for a remote group. -``` - -The remote list format is flexible. VyOS attempts to parse the first word of -each line as an entry and skips lines it cannot match. Lines that begin with -an alphanumeric character but do not match valid IPv4 or IPv6 addresses, -ranges, or CIDRs are logged to the system log. The following examples show -acceptable formats that VyOS parses correctly: - -```none -127.0.0.1 -127.0.0.0/24 -127.0.0.1-127.0.0.254 -2001:db8::1 -2001:db8:cafe::/48 -2001:db8:cafe::1-2001:db8:cafe::ffff -``` - -### Network Groups - -**Network groups** accept IP networks in CIDR notation. You can add specific -IP addresses as a 32-bit prefix. If you need to add a mix of addresses and -networks, use a network group. - -```{eval-rst} -.. cfgcmd:: set firewall group network-group network -``` - -```{eval-rst} -.. cfgcmd:: set firewall group ipv6-network-group network - - Define an IPv4 or IPv6 network group. - - .. code-block:: none - - set firewall group network-group NET-INSIDE-v4 network 192.168.0.0/24 - set firewall group network-group NET-INSIDE-v4 network 192.168.1.0/24 - set firewall group ipv6-network-group NET-INSIDE-v6 network 2001:db8::/64 -``` - -```{eval-rst} -.. cfgcmd:: set firewall group network-group description -``` - -```{eval-rst} -.. cfgcmd:: set firewall group ipv6-network-group description - - Provide an IPv4 or IPv6 network group description. -``` - -### Interface Groups - -An **interface group** represents a collection of interfaces. - -```{eval-rst} -.. cfgcmd:: set firewall group interface-group interface - - Define an interface group. - Wildcard ``*`` is supported. For example: ``eth3*``. - Prepend the character ``!`` to invert the criteria. For example: ``!eth2``. -``` - -```none -set firewall group interface-group LAN interface bond1001 -set firewall group interface-group LAN interface eth3* -``` - -```{eval-rst} -.. cfgcmd:: set firewall group interface-group description - - Provide an interface group description. -``` - -### Port Groups - -A **port group** represents only port numbers, not the protocol. You can -reference port groups for either TCP or UDP. Create TCP and UDP groups -separately to avoid accidentally filtering unnecessary ports. Specify port -ranges by using `-`. - -```{eval-rst} -.. cfgcmd:: set firewall group port-group port - [portname | portnumber | startport-endport] - - Define a port group. A port name can be any name defined in - /etc/services. For example, ``http``. - - .. code-block:: none - - set firewall group port-group PORT-TCP-SERVER1 port http - set firewall group port-group PORT-TCP-SERVER1 port 443 - set firewall group port-group PORT-TCP-SERVER1 port 5000-5010 -``` - -```{eval-rst} -.. cfgcmd:: set firewall group port-group description - - Provide a port group description. -``` - -### MAC Groups - -A **mac group** represents a collection of mac addresses. - -```{eval-rst} -.. cfgcmd:: set firewall group mac-group mac-address - - Define a mac group. -``` - -```none -set firewall group mac-group MAC-G01 mac-address 88:a4:c2:15:b6:4f -set firewall group mac-group MAC-G01 mac-address 4c:d5:77:c0:19:81 -``` - -```{eval-rst} -.. cfgcmd:: set firewall group mac-group description - - Provide a MAC group description. -``` - -### Domain Groups - -A **domain group** represents a collection of domains. - -```{eval-rst} -.. cfgcmd:: set firewall group domain-group address - - Define a domain group. -``` - -```none -set firewall group domain-group DOM address example.com -``` - -```{eval-rst} -.. cfgcmd:: set firewall group domain-group description - - Provide a domain group description. -``` - -### Dynamic Groups - -Firewall dynamic groups differ from other groups because you can use them as -source/destination in firewall rules, and members are not defined statically -in VyOS configuration. Instead, firewall rules dynamically add members to -these groups. - -#### Defining Dynamic Address Groups - -Dynamic address groups support both IPv4 and IPv6 families. Use these -commands to define dynamic IPv4 and IPv6 address groups: - -```{eval-rst} -.. cfgcmd:: set firewall group dynamic-group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall group dynamic-group ipv6-address-group -``` - -Add description to firewall groups: - -```{eval-rst} -.. cfgcmd:: set firewall group dynamic-group address-group - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall group dynamic-group ipv6-address-group - description -``` - -#### Adding elements to Dynamic Firewall Groups - -After you define dynamic firewall groups, use them in firewall rules to -dynamically add elements to them. - -Commands used for this task are: - -- Add destination IP address of the connection to a dynamic address group: - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule - <1-999999> add-address-to-group destination-address address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group - destination-address address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule - <1-999999> add-address-to-group destination-address address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group - destination-address address-group -``` - -- Add source IP address of the connection to a dynamic address group: - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule - <1-999999> add-address-to-group source-address address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group - source-address address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule - <1-999999> add-address-to-group source-address address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group - source-address address-group -``` - -You can define specific timeouts per rule. When a rule matches, the source or -destination address is added to the group, and the element remains in the group -until the timeout expires. If you do not define a timeout, the element remains -in the group until the next reboot or until you commit firewall configuration -changes. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 [forward | input | output] filter rule - <1-999999> add-address-to-group [destination-address | source-address] - timeout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> add-address-to-group - [destination-address | source-address] timeout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 [forward | input | output] filter rule - <1-999999> add-address-to-group [destination-address | source-address] - timeout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> add-address-to-group - [destination-address | source-address] timeout -``` - -Timeout can be defined using seconds, minutes, hours or days: - -```none -set firewall ipv6 name FOO rule 10 add-address-to-group source-address timeout -Possible completions: -s Timeout value in seconds -m Timeout value in minutes -h Timeout value in hours -d Timeout value in days -``` - -#### Using Dynamic Firewall Groups - -Like other firewall groups, you can use dynamic firewall groups in firewall -rules as matching options. For example: - -```none -set firewall ipv4 input filter rule 10 source group dynamic-address-group FOO -set firewall ipv4 input filter rule 10 destination group dynamic-address-group BAR -``` - -## Examples - -### General example - -After you create firewall groups, you can reference them in firewall, NAT, -NAT66, and/or policy-route rules. The following example creates multiple -groups: - -```none -set firewall group address-group SERVERS address 198.51.100.101 -set firewall group address-group SERVERS address 198.51.100.102 -set firewall group network-group TRUSTEDv4 network 192.0.2.0/30 -set firewall group network-group TRUSTEDv4 network 203.0.113.128/25 -set firewall group ipv6-network-group TRUSTEDv6 network 2001:db8::/64 -set firewall group interface-group LAN interface eth2.2001 -set firewall group interface-group LAN interface bon0 -set firewall group port-group PORT-SERVERS port http -set firewall group port-group PORT-SERVERS port 443 -set firewall group port-group PORT-SERVERS port 5000-5010 -``` - -And next, some configuration example where groups are used: - -```none -set firewall ipv4 output filter rule 10 action accept -set firewall ipv4 output filter rule 10 outbound-interface group !LAN -set firewall ipv4 forward filter rule 20 action accept -set firewall ipv4 forward filter rule 20 source group network-group TRUSTEDv4 -set firewall ipv6 input filter rule 10 action accept -set firewall ipv6 input filter rule 10 source group network-group TRUSTEDv6 -set nat destination rule 101 inbound-interface group LAN -set nat destination rule 101 destination group address-group SERVERS -set nat destination rule 101 protocol tcp -set nat destination rule 101 destination group port-group PORT-SERVERS -set nat destination rule 101 translation address 203.0.113.250 -set policy route PBR rule 201 destination group port-group PORT-SERVERS -set policy route PBR rule 201 protocol tcp -set policy route PBR rule 201 set table 15 -``` - -### Port knocking example - -You can use dynamic firewall groups with port knocking to secure access to -the router or any other device. The following example shows a 4-step port -knocking configuration: - -```none -set firewall global-options state-policy established action 'accept' -set firewall global-options state-policy invalid action 'drop' -set firewall global-options state-policy related action 'accept' -set firewall group dynamic-group address-group ALLOWED -set firewall group dynamic-group address-group PN_01 -set firewall group dynamic-group address-group PN_02 -set firewall ipv4 input filter default-action 'drop' -set firewall ipv4 input filter rule 5 action 'accept' -set firewall ipv4 input filter rule 5 protocol 'icmp' -set firewall ipv4 input filter rule 10 action 'drop' -set firewall ipv4 input filter rule 10 add-address-to-group source-address address-group 'PN_01' -set firewall ipv4 input filter rule 10 add-address-to-group source-address timeout '2m' -set firewall ipv4 input filter rule 10 description 'Port_nock 01' -set firewall ipv4 input filter rule 10 destination port '9990' -set firewall ipv4 input filter rule 10 protocol 'tcp' -set firewall ipv4 input filter rule 20 action 'drop' -set firewall ipv4 input filter rule 20 add-address-to-group source-address address-group 'PN_02' -set firewall ipv4 input filter rule 20 add-address-to-group source-address timeout '3m' -set firewall ipv4 input filter rule 20 description 'Port_nock 02' -set firewall ipv4 input filter rule 20 destination port '9991' -set firewall ipv4 input filter rule 20 protocol 'tcp' -set firewall ipv4 input filter rule 20 source group dynamic-address-group 'PN_01' -set firewall ipv4 input filter rule 30 action 'drop' -set firewall ipv4 input filter rule 30 add-address-to-group source-address address-group 'ALLOWED' -set firewall ipv4 input filter rule 30 add-address-to-group source-address timeout '2h' -set firewall ipv4 input filter rule 30 description 'Port_nock 03' -set firewall ipv4 input filter rule 30 destination port '9992' -set firewall ipv4 input filter rule 30 protocol 'tcp' -set firewall ipv4 input filter rule 30 source group dynamic-address-group 'PN_02' -set firewall ipv4 input filter rule 99 action 'accept' -set firewall ipv4 input filter rule 99 description 'Port_nock 04 - Allow ssh' -set firewall ipv4 input filter rule 99 destination port '22' -set firewall ipv4 input filter rule 99 protocol 'tcp' -set firewall ipv4 input filter rule 99 source group dynamic-address-group 'ALLOWED' -``` - -Before testing, we can check the members of firewall groups: - -```none -vyos@vyos# run show firewall group -Firewall Groups - -Name Type References Members Timeout Expires -------- ---------------------- -------------------- ------------- --------- --------- -ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D -PN_01 address_group(dynamic) ipv4-input-filter-10 N/D N/D N/D -PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D -[edit] -vyos@vyos# -``` - -With this configuration, to gain SSH access to the router, the user must: - -1. Create a new TCP connection to destination port 9990. A new entry is added - to dynamic firewall group `PN_01`. - - ```none - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 119 - PN_02 address_group(dynamic) ipv4-input-filter-20 N/D N/D N/D - [edit] - vyos@vyos# - ``` - -2. Create a new TCP connection to destination port 9991. A new entry is added - to dynamic firewall group `PN_02`. - - ```none - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 N/D N/D N/D - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 106 - PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 179 - [edit] - vyos@vyos# - ``` - -3. Create a new TCP connection to destination port 9992. A new entry is added - to dynamic firewall group `ALLOWED`. - - ```none - vyos@vyos# run show firewall group - Firewall Groups - - Name Type References Members Timeout Expires - ------- ---------------------- -------------------- ------------- --------- --------- - ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.89.31 7200 7199 - PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.89.31 120 89 - PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.89.31 180 170 - [edit] - vyos@vyos# - ``` - -4. Now you can connect via SSH to the router (assuming SSH is - configured). - -## Operation-mode - -```{eval-rst} -.. opcmd:: show firewall group -``` - -```{eval-rst} -.. opcmd:: show firewall group - - Display an overview of defined groups, including the firewall group name, - type, references (where the group is used), members, timeout, and - expiration (the last two only apply to dynamic firewall groups). -``` - -Here is an example of such command: - -```none -vyos@vyos:~$ show firewall group -Firewall Groups - -Name Type References Members Timeout Expires ------------- ---------------------- ---------------------- ---------------- --------- --------- -SERVERS address_group nat-destination-101 198.51.100.101 - 198.51.100.102 -ALLOWED address_group(dynamic) ipv4-input-filter-30 192.168.77.39 7200 7174 -PN_01 address_group(dynamic) ipv4-input-filter-10 192.168.0.245 120 112 - 192.168.77.39 120 85 -PN_02 address_group(dynamic) ipv4-input-filter-20 192.168.77.39 180 151 -LAN interface_group ipv4-output-filter-10 bon0 - nat-destination-101 eth2.2001 -TRUSTEDv6 ipv6_network_group ipv6-input-filter-10 2001:db8::/64 -TRUSTEDv4 network_group ipv4-forward-filter-20 192.0.2.0/30 - 203.0.113.128/25 -PORT-SERVERS port_group route-PBR-201 443 - route-PBR-201 5000-5010 - nat-destination-101 http -vyos@vyos:~$ -``` diff --git a/docs/configuration/firewall/md-index.md b/docs/configuration/firewall/md-index.md deleted file mode 100644 index 204744d5..00000000 --- a/docs/configuration/firewall/md-index.md +++ /dev/null @@ -1,236 +0,0 @@ -lastproofread -2024-08-05 - -# Firewall - -
- -Convert raw command blocks in this file to cfgcmd/opcmd -directives for command coverage tracking. - -
- -
- -
- -Warning - -
- -Due to a race condition that can lead to a failure during boot -process, all interfaces are initialized before firewall is configured. This -leads to a situation where the system is open to all traffic, and can be -considered as a security risk. - -
- -As VyOS is based on Linux it leverages its firewall. The Netfilter project -created iptables and its successor nftables for the Linux kernel to -work directly on packet data flows. This now extends the concept of -zone-based security to allow for manipulating the data at multiple stages once -accepted by the network interface and the driver before being handed off to -the destination (e.g., a web server OR another device). - -A simplified traffic flow diagram, based on Netfilter packet flow, is shown -next, in order to have a full view and understanding of how packets are -processed, and what possible paths traffic can take. - -
- -
- -The main points regarding this packet flow and terminology used in VyOS -firewall are covered below: - -> - **Bridge Port?**: choose appropriate path based on whether interface -> where the packet was received is part of a bridge, or not. - -If the interface where the packet was received isn't part of a bridge, then -packet is processed at the **IP Layer**: - -> - **Prerouting**: All packets that are received by the router -> are processed in this stage, regardless of the destination of the packet. -> Starting from vyos-1.5-rolling-202406120020, a new section was added to -> the firewall configuration. There are several actions that can be done in -> this stage, and currently these actions are also defined in different -> parts of the VyOS configuration. Order is important, and the relevant -> configuration that acts in this stage are: -> -> > - **Firewall prerouting**: rules defined under `set firewall [ipv4 | ipv6] prerouting raw...`. All rules defined in this section are -> > processed before connection tracking subsystem. -> > - **Conntrack Ignore**: rules defined under `set system conntrack ignore [ipv4 | ipv6] ...`. Starting from vyos-1.5-rolling-202406120020, -> > configuration done in this section can be done in `firewall [ipv4 | ipv6] prerouting ...`. For compatibility reasons, this feature is -> > still present, but it will be removed in the future. -> > - **Policy Route**: rules defined under `set policy [route | route6] ...`. -> > - **Destination NAT**: rules defined under `set [nat | nat66] destination...`. -> -> - **Destination is the router?**: choose an appropriate path based on -> destination IP address. Transit forward continues to **forward**, -> while traffic where the destination IP address is configured on the router -> continues to **input**. -> -> - **Input**: stage where traffic destined for the router itself can be -> filtered and controlled. This is where all rules for securing the router -> should take place. This includes ipv4 and ipv6 filtering rules, defined -> in: -> -> - `set firewall ipv4 input filter ...`. -> - `set firewall ipv6 input filter ...`. -> -> - **Forward**: stage where transit traffic can be filtered and controlled. -> This includes ipv4 and ipv6 filtering rules, defined in: -> -> - `set firewall ipv4 forward filter ...`. -> - `set firewall ipv6 forward filter ...`. -> -> - **Output**: stage where traffic that originates from the router itself -> can be filtered and controlled. Bear in mind that this traffic can be a -> new connection originated by a internal process running on the VyOS router -> such as NTP, or a response to traffic received externally through -> **input** (for example response to an ssh login attempt to the router). -> This includes ipv4 and ipv6 rules, and two different sections are present: -> -> - **Output Prerouting**: `set firewall [ipv4 | ipv6] output raw ...`. -> As described in **Prerouting**, rules defined in this section are -> processed before connection tracking subsystem. -> - **Output Filter**: `set firewall [ipv4 | ipv6] output filter ...`. -> -> - **Postrouting**: as in **Prerouting**, several actions defined in -> different parts of VyOS configuration are performed in this -> stage. This includes: -> -> - **Source NAT**: rules defined under `set [nat | nat66] source...`. - -If the interface where the packet was received is part of a bridge, then -the packet is processed at the **Bridge Layer**: - -> - **Prerouting (Bridge)**: all packets that are received by the bridge are -> processed in this stage, regardless of the destination of the packet. -> First filters can be applied here, and/or also configure rules for -> ignoring connection tracking system. The relevant configuration that -> acts in: -> - `set firewall bridge prerouting filter ...`. -> - **Forward (Bridge)**: stage where traffic that is trespassing through the -> bridge is filtered and controlled: -> - `set firewall bridge forward filter ...`. -> - **Input (Bridge)**: stage where traffic destined for the bridge itself can -> be filtered and controlled: -> - `set firewall bridge input filter ...`. -> - **Output (Bridge)**: stage where traffic that originates from the bridge -> itself can be filtered and controlled: -> - `set firewall bridge output filter ...`. - -The main structure of the VyOS firewall CLI is shown next: - -``` none -- set firewall - * bridge - - forward - + filter - - input - + filter - - output - + filter - - prerouting - + filter - - name - + custom_name - * flowtable - - custom_flow_table - + ... - * global-options - + all-ping - + broadcast-ping - + ... - * group - - address-group - - ipv6-address-group - - network-group - - ipv6-network-group - - interface-group - - mac-group - - port-group - - domain-group - * ipv4 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name - * ipv6 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - ipv6-name - + custom_name - * zone - - custom_zone_name - + ... -``` - -Please, refer to appropriate section for more information about firewall -configuration: - -
- -global-options -groups -bridge -ipv4 -ipv6 -flowtables - -
- -
- -
- -Note - -
- -**For more information** -of Netfilter hooks and Linux networking packet flows can be -found in [Netfilter-Hooks](https://wiki.nftables.org/wiki-nftables/index.php/Netfilter_hooks) - -
- -## Zone-based firewall - -
- -zone - -
- -With zone-based firewalls a new concept was implemented, in addition to the -standard in and out traffic flows, a local flow was added. This local flow was -for traffic originating and destined to the router itself. Which means that -additional rules were required to secure the firewall itself from the network, -in addition to the existing inbound and outbound rules from the traditional -concept above. - -To configure VyOS with the -`zone-based firewall configuration ` - -As the example image below shows, the device now needs rules to allow/block -traffic to or from the services running on the device that have open -connections on that interface. - -
- -
diff --git a/docs/configuration/firewall/md-ipv4.md b/docs/configuration/firewall/md-ipv4.md deleted file mode 100644 index cf6e2231..00000000 --- a/docs/configuration/firewall/md-ipv4.md +++ /dev/null @@ -1,2099 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-ipv4-configuration)= - -# IPv4 Firewall Configuration - -## Overview - -This section provides information on IPv4 firewall configuration and -appropriate operation-mode commands. This section covers the following -configuration commands: - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 ... -``` - -To learn about the general traffic flow in VyOS firewalls, -see {doc}`Firewall `. - -```none -- set firewall - * ipv4 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name -``` - -First, the router receives all traffic and processes it in the **prerouting** -stage. - -This stage includes: - -> - **Firewall Prerouting**: commands found under `set firewall ipv4 -> prerouting raw ...` -> - {doc}`Conntrack Ignore`: `set system -> conntrack ignore ipv4...` -> - {doc}`Policy Route`: commands found under -> `set policy route ...` -> - {doc}`Destination NAT`: commands found under -> `set nat destination ...` - -For transit traffic, which is received by the router and forwarded, the base -chain is **forward**. The following is a simplified packet flow diagram for -transit traffic: - -:::{figure} /_static/images/firewall-fwd-packet-flow.webp -::: - -The base firewall chain for configuring filtering rules for transit traffic is -`set firewall ipv4 forward filter ...`, which occurs in stage 5, highlighted -in red. - -For traffic to the router itself, the base chain is **input**. For traffic -the router originates, the base chain is **output**. A simplified packet flow -diagram is shown next, which shows the path for traffic destined to the router -itself and traffic the router generates (starting from circle number 6): - -:::{figure} /_static/images/firewall-input-packet-flow.webp -::: - -The base chain for traffic towards the router is -`set firewall ipv4 input filter ...` - -The base chain for traffic the router generates is `set firewall ipv4 -output ...`, where two sub-chains are available: **filter** and **raw**: - -- **Output Prerouting**: `set firewall ipv4 output raw ...`. As described - in **Prerouting**, the system processes rules in this section before the - connection tracking subsystem. -- **Output Filter**: `set firewall ipv4 output filter ...`. The system - processes rules in this section after the connection tracking subsystem. - -:::{note} -**Important note about default-actions:** -If you do not define a default action for a base chain, the system sets -the default action to **accept** for that chain. For custom chains, if you -do not define a default action, the system sets the default-action to -**drop**. -::: - -You can create custom firewall chains using the following commands: -`set firewall ipv4 name ...`. To use a custom chain, you must define -a rule with the **action jump** and the appropriate **target** in a base -chain. - -## Firewall - IPv4 Rules - -Each firewall rule has a -number, an action to apply if the rule matches, and the ability to specify -multiple matching criteria. Packets traverse rules numbered 1-999999, so order -is crucial. The system executes the rule action at the first match. - -### Actions - -If you define a rule, you must define an action for it. The action tells the -firewall what to do if all the criteria you define for that rule are met. - -The action can be: - -> - `accept`: Accept the packet. -> - `continue`: Continue parsing the next rule. -> - `drop`: Drop the packet. -> - `reject`: Reject the packet. -> - `jump`: Jump to another custom chain. -> - `return`: Return from the current chain and continue at the next rule -> of the last chain. -> - `queue`: Enqueue packet to userspace. -> - `synproxy`: Synproxy the packet. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return | synproxy] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return | synproxy] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return] - - This required setting defines the action of the current rule. If you set - the action to jump, you must also specify a jump-target. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - jump-target - - Use this command only when the action is set to ``jump``. Specify the - jump target. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - queue <0-65535> - - Use this command only when the action is set to ``queue``. Specify the - queue target to use. Queue range is also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - queue-options bypass - - Use this command only when the action is set to ``queue``. Allow the packet - to pass through the firewall when no userspace software is connected to the - queue. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - queue-options fanout - - Use this command only when the action is set to ``queue``. Distribute - packets between several queues. -``` - -Also, **default-action** is an action that applies when a packet does not -match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name default-action - [accept | drop | jump | queue | reject | return] - - This command sets the default action of the rule-set if a packet does not - match the criteria of any rule. If you set the default-action to ``jump``, - you must also specify ``default-jump-target``. Note that for base chains, - you can set the default action only to ``accept`` or ``drop``, while on - custom chains, more actions are available. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name default-jump-target - - Use this command only when you set ``default-action`` to ``jump``. Specify - the jump target for the default rule. -``` - -:::{note} -**Important note about default-actions:** -If you do not define a default action for a base chain, the system sets -the default action to **accept** for that chain. For custom chains, if you -do not define a default action, the system sets the default-action to -**drop**. -::: - -### Firewall Logs - -You can enable logging for every single firewall rule. If you enable logging, -you can define other log options. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> log - - Enable logging for the matched packet. If this command is not present, then - logging is not enabled. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name default-log - - Use this command to enable logging of the default action on the specified - chain. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] - - Define the log level. Only applicable if you enable rule logging. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - log-options group <0-65535> - - Define the log group to send messages to. Only applicable if you enable rule - logging. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - log-options snapshot-length <0-9000> - - Define the length of packet payload to include in a netlink message. Only - applicable if you enable rule logging and define the log group. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - log-options queue-threshold <0-65535> - - Define the number of packets to queue inside the kernel before sending them - to userspace. Only applicable if you enable rule logging and define the log - group. -``` - -### Firewall Description - -You can add a description for reference for every single rule and for every -defined custom chain. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name description - - Provide a rule-set description for a custom firewall chain. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> description - - Provide a description for each rule. -``` - -### Rule Status - -When you define a rule, it is enabled by default. In some cases, it is useful -to disable the rule rather than removing it. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> disable - - Command for disabling a rule but keeping it in the configuration. -``` - -### Matching criteria - -There are a lot of matching criteria against which the packet can be tested. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - connection-status nat [destination | source] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - connection-status nat [destination | source] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - connection-status nat [destination | source] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - connection-status nat [destination | source] - - Match based on nat connection status. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - connection-mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - connection-mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - connection-mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - connection-mark <1-2147483647> - - Match based on connection mark. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - conntrack-helper -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - conntrack-helper -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - conntrack-helper -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - conntrack-helper - - Match based on connection tracking protocol helper module to secure use of - that helper module. See below for possible completions ``. - - .. code-block:: none - - Possible completions: - ftp Related traffic from FTP helper - h323 Related traffic from H.323 helper - pptp Related traffic from PPTP helper - nfs Related traffic from NFS helper - sip Related traffic from SIP helper - tftp Related traffic from TFTP helper - sqlnet Related traffic from SQLNet helper -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination address [address | addressrange | CIDR] - - Match criteria based on source and/or destination address. This is similar - to the network groups part, but here you are able to negate the matching - addresses. - - .. code-block:: none - - set firewall ipv4 name FOO rule 50 source address 192.0.2.10-192.0.2.11 - # with a '!' the rule match everything except the specified subnet - set firewall ipv4 name FOO rule 51 source address !203.0.113.0/24 -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination address-mask [address] - - An arbitrary netmask can be applied to mask addresses to only match against - a specific portion. - - This functions for both individual addresses and address groups. - - .. code-block:: none - - # Match any IPv4 address with `11` as the 2nd octet and `13` as the forth octet - set firewall ipv4 name FOO rule 100 destination address 0.11.0.13 - set firewall ipv4 name FOO rule 100 destination address-mask 0.255.0.255 -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination fqdn - - Specify a Fully Qualified Domain Name as source/destination to match. Ensure - that the router is able to resolve this dns query. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination geoip inverse-match - - Match IP addresses based on its geolocation. More info: `geoip matching - `_. - Use inverse-match to match anything except the given country-codes. -``` - -Data is provided by DB-IP.com under CC-BY-4.0 license. Attribution required, -permits redistribution so we can include a database in images(~3MB -compressed). Includes cron script (manually callable by op-mode update -geoip) to keep database and rules updated. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source mac-address -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source mac-address -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source mac-address -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source mac-address - - You can only specify a source mac-address to match. - - .. code-block:: none - - set firewall ipv4 input filter rule 100 source mac-address 00:53:00:11:22:33 - set firewall ipv4 input filter rule 101 source mac-address !00:53:00:aa:12:34 -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination port [1-65535 | portname | start-end] - - A port can be set by number or name as defined in ``/etc/services``. - - .. code-block:: none - - set firewall ipv4 forward filter rule 10 source port '22' - set firewall ipv4 forward filter rule 11 source port '!http' - set firewall ipv4 forward filter rule 12 source port 'https' - - Multiple source ports can be specified as a comma-separated list. - The whole list can also be "negated" using ``!``. For example: -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group address-group - - Use a specific address-group. Prepending the character ``!`` to invert the - criteria to match is also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group dynamic-address-group - - Use a specific dynamic-address-group. Prepending the character ``!`` to - invert the criteria to match is also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group network-group - - Use a specific network-group. Prepending the character ``!`` to invert the - criteria to match is also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group port-group - - Use a specific port-group. Prepending the character ``!`` to invert the - criteria to match is also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group domain-group - - Use a specific domain-group. Prepending the character ``!`` to invert the - criteria to match is also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - source group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - source group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - source group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - source group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - destination group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - destination group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - destination group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - destination group mac-group - - Use a specific mac-group. Prepending the character ``!`` to invert the - criteria to match is also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - dscp [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - dscp [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - dscp [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - dscp [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - dscp-exclude [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - dscp-exclude [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - dscp-exclude [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - dscp-exclude [0-63 | start-end] - - Match based on dscp value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - fragment [match-frag | match-non-frag] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - fragment [match-frag | match-non-frag] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - fragment [match-frag | match-non-frag] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - fragment [match-frag | match-non-frag] - - Match based on fragmentation. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - icmp [code | type] <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - icmp [code | type] <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - icmp [code | type] <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - icmp [code | type] <0-255> - - Match based on icmp code and type. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - icmp type-name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - icmp type-name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - icmp type-name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - icmp type-name - - Match based on icmp type-name. Use tab for information - about what **type-name** criteria are supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - inbound-interface name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - inbound-interface name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - inbound-interface name - - Match based on inbound interface. Wildcard ``*`` is supported. For example: - ``eth2*``. Prepend the character ``!`` to invert the criteria. For example: - ``!eth2`` -``` - -:::{note} -If an interface is attached to a non-default vrf, when using -**inbound-interface**, the vrf name must be used. For example `set firewall -ipv4 forward filter rule 10 inbound-interface name MGMT` -::: - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - inbound-interface group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - inbound-interface group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - inbound-interface group - - Match based on the inbound interface group. Prepend the character ``!`` to - invert the criteria. For example, ``!IFACE_GROUP`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - outbound-interface name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - outbound-interface name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - outbound-interface name - - Match based on outbound interface. Wildcard ``*`` is supported. For example: - ``eth2*``. Prepend the character ``!`` to invert the criteria. For example: - ``!eth2`` -``` - -:::{note} -If an interface is attached to a non-default vrf, when using -**outbound-interface**, the real interface name must be used. For example -`set firewall ipv4 forward filter rule 10 outbound-interface name eth0` -::: - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - outbound-interface group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - outbound-interface group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - outbound-interface group - - Match based on outbound interface group. Prepend the character ``!`` to - invert the criteria. For example: ``!IFACE_GROUP`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - ipsec [match-ipsec-in | match-none-in] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - ipsec [match-ipsec-out | match-none-out] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] - - Match based on ipsec. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - limit burst <0-4294967295> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - limit burst <0-4294967295> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - limit burst <0-4294967295> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - limit burst <0-4294967295> - - Match based on the maximum number of packets to allow in excess of rate. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - limit rate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - limit rate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - limit rate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - limit rate - - Specify the maximum average rate as **integer/unit**. For example: - **5/minutes** -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - packet-length -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - packet-length -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - packet-length -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - packet-length -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - packet-length-exclude -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - packet-length-exclude -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - packet-length-exclude -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - packet-length-exclude - - Match based on packet length. Specify multiple values from 1 to 65535 and - ranges. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - packet-type [broadcast | host | multicast | other] - - Match based on the packet type. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] - - Match based on protocol number or name as defined in ``/etc/protocols``. - Special names are ``all`` for all protocols and ``tcp_udp`` for TCP and UDP - based packets. The ``!`` character negates the selected protocol. - - .. code-block:: none - - set firewall ipv4 forward filter rule 10 protocol tcp_udp - set firewall ipv4 forward filter rule 11 protocol !tcp_udp -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - recent time [second | minute | hour] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - recent time [second | minute | hour] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - recent time [second | minute | hour] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - recent time [second | minute | hour] - - Match based on recently seen sources. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - tcp flags [not] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - tcp flags [not] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - tcp flags [not] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - tcp flags [not] - - Specify TCP flags. Allowed values are ``ack``, ``cwr``, ``ecn``, ``fin``, - ``psh``, ``rst``, ``syn``, and ``urg``. Specify multiple values, and use - ``not`` for inverted selection, as shown in the example. - - .. code-block:: none - - set firewall ipv4 input filter rule 10 tcp flags 'ack' - set firewall ipv4 input filter rule 12 tcp flags 'syn' - set firewall ipv4 input filter rule 13 tcp flags not 'fin' -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - state [established | invalid | new | related] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - state [established | invalid | new | related] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - state [established | invalid | new | related] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - state [established | invalid | new | related] - - Match against the state of a packet. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time startdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time startdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time startdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time startdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time starttime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time starttime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time starttime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time starttime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time stopdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time stopdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time stopdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time stopdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time stoptime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time stoptime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time stoptime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time stoptime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - time weekdays -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - time weekdays -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - time weekdays -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - time weekdays - - Time to match the defined rule. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - ttl <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 input filter rule <1-999999> - ttl <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output filter rule <1-999999> - ttl <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 name rule <1-999999> - ttl <0-255> - - Match the time to live parameter, where 'eq' means 'equal', 'gt' means - 'greater than', and 'lt' means 'less than'. -``` - -### Packet Modifications - -Starting from **VyOS-1.5-rolling-202410060007**, the firewall can modify -packets before sending them out. This feature provides more flexibility in -packet handling. - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> - set dscp <0-63> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set dscp <0-63> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set dscp <0-63> - - Set a specific value of Differentiated Services Codepoint (DSCP). -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> - set mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set mark <1-2147483647> - - Set a specific packet mark value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> - set tcp-mss <500-1460> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set tcp-mss <500-1460> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set tcp-mss <500-1460> - - Set the TCP-MSS (TCP maximum segment size) for the connection. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 prerouting raw rule <1-999999> - set ttl <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set ttl <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set ttl <0-255> - - Set the TTL (Time to Live) value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 forward filter rule <1-999999> - set connection-mark <0-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 output [filter | raw] rule <1-999999> - set connection-mark <0-2147483647> - - Set connection mark value. -``` - -## Synproxy - -Synproxy connections - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> - action synproxy -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> - protocol tcp -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> - synproxy tcp mss <501-65535> - - Set the TCP-MSS (maximum segment size) for the connection -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv4 [input | forward] filter rule <1-999999> - synproxy tcp window-scale <1-14> - - Set the window scale factor for TCP window scaling -``` - -### Example synproxy - -Requirements to enable synproxy: - -> - Traffic must be symmetric. -> - Synproxy relies on syncookies and TCP timestamps, ensure these are enabled. -> - Disable conntrack loose track option. - -```none -set system sysctl parameter net.ipv4.tcp_timestamps value '1' - -set system conntrack tcp loose disable -set system conntrack ignore ipv4 rule 10 destination port '8080' -set system conntrack ignore ipv4 rule 10 protocol 'tcp' -set system conntrack ignore ipv4 rule 10 tcp flags syn - -set firewall global-options syn-cookies 'enable' -set firewall ipv4 input filter rule 10 action 'synproxy' -set firewall ipv4 input filter rule 10 destination port '8080' -set firewall ipv4 input filter rule 10 inbound-interface name 'eth1' -set firewall ipv4 input filter rule 10 protocol 'tcp' -set firewall ipv4 input filter rule 10 synproxy tcp mss '1460' -set firewall ipv4 input filter rule 10 synproxy tcp window-scale '7' -set firewall ipv4 input filter rule 1000 action 'drop' -set firewall ipv4 input filter rule 1000 state invalid -``` - -## Operation-mode Firewall - -### Rule-set overview - -```{eval-rst} -.. opcmd:: show firewall - - This will show you a basic firewall overview, for all rule-sets, not - only for IPv4. - - .. code-block:: none - - vyos@vyos:~$ show firewall - Rulesets Information - - --------------------------------- - ipv4 Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------- - 20 accept all 0 0 ip saddr @N_TRUSTEDv4 accept - 21 jump all 0 0 jump NAME_AUX - default accept all 0 0 - - --------------------------------- - ipv4 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ------------------------- - 10 accept all 156 14377 iifname != @I_LAN accept - default accept all 0 0 - - --------------------------------- - ipv4 Firewall "name AUX" - - Rule Action Protocol Packets Bytes Conditions - ------ -------- ---------- --------- ------- -------------------------------------------- - 10 accept icmp 0 0 meta l4proto icmp accept - 20 accept udp 0 0 meta l4proto udp ip saddr @A_SERVERS accept - 30 drop all 0 0 ip saddr != @A_SERVERS iifname "eth2" - - --------------------------------- - ipv4 Firewall "output filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ---------------------------------------- - 10 reject all 0 0 oifname @I_LAN - 20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept - default accept all 72 9258 - - --------------------------------- - ipv6 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ------------------------------- - 10 accept all 0 0 ip6 saddr @N6_TRUSTEDv6 accept - default accept all 2 112 - - vyos@vyos:~$ -``` - -```{eval-rst} -.. opcmd:: show firewall summary - - This shows you a summary of rule-sets and groups. - - .. code-block:: none - - vyos@vyos:~$ show firewall summary - Ruleset Summary - - IPv6 Ruleset: - - Ruleset Hook Ruleset Priority Description - -------------- -------------------- ------------------------- - forward filter - input filter - ipv6_name IPV6-VyOS_MANAGEMENT - ipv6_name IPV6-WAN_IN PUBLIC_INTERNET - - IPv4 Ruleset: - - Ruleset Hook Ruleset Priority Description - -------------- ------------------ ------------------------- - forward filter - input filter - name VyOS_MANAGEMENT - name WAN_IN PUBLIC_INTERNET - - Firewall Groups - - Name Type References Members - ----------------------- ------------------ ----------------------- ---------------- - PBX address_group WAN_IN-100 198.51.100.77 - SERVERS address_group WAN_IN-110 192.0.2.10 - WAN_IN-111 192.0.2.11 - WAN_IN-112 192.0.2.12 - WAN_IN-120 - WAN_IN-121 - WAN_IN-122 - SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 - WAN_IN-20 - PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 - PINGABLE_ADRESSES address_group WAN_IN-170 192.168.5.2 - WAN_IN-171 - PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 - SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 - IPV6-WAN_IN-111 2001:db8::3 - IPV6-WAN_IN-112 2001:db8::4 - IPV6-WAN_IN-120 - IPV6-WAN_IN-121 - IPV6-WAN_IN-122 - SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 - IPV6-WAN_IN-20 - -``` - -```{eval-rst} -.. opcmd:: show firewall ipv4 [forward | input | output] filter -``` - -```{eval-rst} -.. opcmd:: show firewall ipv4 name - - This command will give an overview of a single rule-set. - - .. code-block:: none - - vyos@vyos:~$ show firewall ipv4 input filter - Ruleset Information - - --------------------------------- - IPv4 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------------------- - 5 jump all 0 0 iifname "eth2" jump NAME_VyOS_MANAGEMENT - default accept all -``` - -```{eval-rst} -.. opcmd:: show firewall ipv4 [forward | input | output] - filter rule <1-999999> -``` - -```{eval-rst} -.. opcmd:: show firewall ipv4 name rule <1-999999> - - This command gives an overview of a rule in a single rule-set, plus - information for default action. -``` - -```none -vyos@vyos:~$show firewall ipv4 output filter rule 20 -Rule Information - ---------------------------------- -ipv4 Firewall "output filter" - -Rule Action Protocol Packets Bytes Conditions -------- -------- ---------- --------- ------- ---------------------------------------- -20 accept icmp 2 168 meta l4proto icmp oifname "eth0" accept -default accept all 286 47614 - -vyos@vyos:~$ -``` - -```{eval-rst} -.. opcmd:: show firewall statistics - - This will show you statistics of all rule-sets since the last boot. -``` - -### Show Firewall log - -```{eval-rst} -.. opcmd:: show log firewall -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv4 -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv4 [forward | input | output | name] -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv4 [forward | input | output] filter -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv4 name -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv4 [forward | input | output] filter rule -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv4 name rule - - Show the logs of all firewall; show all IPv4 firewall logs; show all logs - for particular hook; show all logs for particular hook and priority; - show all logs for particular custom chain; show logs for specific rule-set. -``` - -### Example Partial Config - -```none -firewall { - group { - network-group BAD-NETWORKS { - network 198.51.100.0/24 - network 203.0.113.0/24 - } - network-group GOOD-NETWORKS { - network 192.0.2.0/24 - } - port-group BAD-PORTS { - port 65535 - } - } - ipv4 { - forward { - filter { - default-action accept - rule 5 { - action accept - source { - group { - network-group GOOD-NETWORKS - } - } - } - rule 10 { - action drop - description "Bad Networks" - protocol all - source { - group { - network-group BAD-NETWORKS - } - } - } - } - } - } -} -``` - -### Update geoip database - -```{eval-rst} -.. opcmd:: update geoip - - Command to update GeoIP database and firewall sets. -``` diff --git a/docs/configuration/firewall/md-ipv6.md b/docs/configuration/firewall/md-ipv6.md deleted file mode 100644 index f732ec44..00000000 --- a/docs/configuration/firewall/md-ipv6.md +++ /dev/null @@ -1,2131 +0,0 @@ ---- -lastproofread: '2026-04-01' ---- - -(firewall-ipv6-configuration)= - -# IPv6 Firewall Configuration - -## Overview - -This section covers useful information about IPv6 firewall configuration and -appropriate operation-mode commands. - -This section describes the following configuration commands: - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 ... -``` - -To learn about the general traffic flow in VyOS firewalls, -see {doc}`Firewall `. - -```none -- set firewall - * ipv6 - - forward - + filter - - input - + filter - - output - + filter - + raw - - prerouting - + raw - - name - + custom_name -``` - -The router first receives all traffic and processes it in the **prerouting** -section. - -This stage includes: - -> - **Firewall Prerouting**: commands found under `set firewall ipv6 -> prerouting raw ...` -> - {doc}`Conntrack Ignore`: `set system -> conntrack ignore ipv6...` -> - {doc}`Policy Route`: commands found under -> `set policy route6 ...` -> - {doc}`Destination NAT`: commands found under -> `set nat66 destination ...` - -For transit traffic that the router receives and forwards, the base chain is -**forward**. The following diagram shows a simplified packet flow for transit -traffic: - -:::{figure} /_static/images/firewall-fwd-packet-flow.webp -::: - -Use `set firewall ipv6 forward filter ...` to configure filtering rules for -transit traffic. This command corresponds to stage 5 and is highlighted in red -in the diagram. - -For traffic destined to the router, use the **input** chain. For traffic the -router generates, use the **output** chain. The following diagram shows the -packet flow for traffic destined to the router and traffic generated by the -router (starting from circle number 6): - -:::{figure} /_static/images/firewall-input-packet-flow.webp -::: - -Use `set firewall ipv6 input filter ...` to configure traffic destined to -the router. - -Use `set firewall ipv6 output ...` to configure traffic the router generates. -Two sub-chains are available: **filter** and **raw**: - -- **Output Prerouting**: `set firewall ipv6 output raw ...`. - As described in **Prerouting**, the firewall processes rules in this - section before the connection tracking subsystem. -- **Output Filter**: `set firewall ipv6 output filter ...`. The firewall - processes rules in this section after the connection tracking subsystem. - -:::{note} -**Important note about default-actions:** -If you do not define a default action for a base chain, the system sets -the default action to **accept** for that chain. For custom chains, if you -do not define a default action, the system sets the default-action to -**drop** -::: - -Create custom firewall chains using the commands -`set firewall ipv6 name ...`. To use the custom chain, define a -rule with **action jump** and the appropriate **target** in a base chain. - -## Firewall - IPv6 Rules - -Create firewall rules for firewall filtering. Each rule is numbered and has -an action to apply when the rule is matched. You can specify multiple matching -criteria. Packets go through rules from 1 - 999999, so order is crucial. The -firewall executes the action of the first matching rule. - -### Actions - -If you define a rule, you must define an action for it. The action tells the -firewall what to do when all criteria for that rule are met. - -The action can be : - -> - `accept`: accept the packet. -> - `continue`: continue parsing next rule. -> - `drop`: drop the packet. -> - `reject`: reject the packet. -> - `jump`: jump to another custom chain. -> - `return`: Return from the current chain and continue at the next rule -> of the last chain. -> - `queue`: Enqueue packet to userspace. -> - `synproxy`: synproxy the packet. - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return | synproxy] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return | synproxy] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> action - [accept | continue | drop | jump | queue | reject | return] - - This required setting defines the action of the current rule. If you set - the action to jump, you must also define a jump-target. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - jump-target -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - jump-target - - Use this command only when action is set to ``jump``. Specify the jump - target. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - queue <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - queue <0-65535> - - Use this command only when action is set to ``queue``. Specify the queue - target. Queue ranges are also supported. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - queue-options bypass -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - queue-options bypass - - Use this command only when action is set to ``queue``. This command allows - the packet to go through the firewall when no userspace software is connected - to the queue. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - queue-options fanout -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - queue-options fanout - - Use this command only when action is set to ``queue``. This command - distributes packets among multiple queues. -``` - -Also, **default-action** is an action that takes place whenever a packet does -not match any rule in its chain. For base chains, possible options for -**default-action** are **accept** or **drop**. - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter default-action - [accept | drop] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name default-action - [accept | drop | jump | queue | reject | return] - - Set the default action of the rule-set if a packet does not match any rule - criteria. If you set default-action to ``jump``, you must also define - ``default-jump-target``. For base chains, you can only set the default - action to ``accept`` or ``drop``. For custom chains, more actions are - available. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name default-jump-target - - To be used only when ``default-action`` is set to ``jump``. Use this - command to specify the jump target for the default rule. -``` - -:::{note} -**Important note about default-actions:** -If you do not define the default action for a base chain, the system sets -the default action to **accept** for that chain. For custom chains, if you -do not define a default action, the system sets the default-action to -**drop**. -::: - -### Firewall Logs - -You can enable logging for each firewall rule. When enabled, you can also -define other log options. - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> log - - Enable logging for matched packets. If this configuration command is not - present, logging is disabled. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter default-log -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name default-log - - Use this command to enable the logging of the default action on - the specified chain. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - log-options level [emerg | alert | crit | err | warn | notice - | info | debug] - - Define log-level. Only applicable if rule log is enabled. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - log-options group <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - log-options group <0-65535> - - Define the log group to send messages to. Only applicable if rule log is - enabled. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - log-options snapshot-length <0-9000> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - log-options snapshot-length <0-9000> - - Define the length of packet payload to include in a netlink message. Only - applicable when rule logging is enabled and log group is defined. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - log-options queue-threshold <0-65535> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - log-options queue-threshold <0-65535> - - Define the number of packets to queue inside the kernel before sending them - to userspace. Only applicable when rule logging is enabled and log group is - defined. -``` - -### Firewall Description - -For reference, you can define descriptions on every rule and custom chain. - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name description - - Provide a rule-set description to a custom firewall chain. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - description -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> description - - Provide a description for each rule. -``` - -### Rule Status - -New rules are enabled by default. In some cases, you may want to disable a -rule rather than remove it. - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> disable -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> disable - - Command for disabling a rule but keep it in the configuration. -``` - -### Matching criteria - -There are a lot of matching criteria against which the packet can be tested. - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - connection-status nat [destination | source] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - connection-status nat [destination | source] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - connection-status nat [destination | source] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - connection-status nat [destination | source] - - Match packets based on NAT connection status. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - connection-mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - connection-mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - connection-mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - connection-mark <1-2147483647> - - Match packets based on connection mark. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination address [address | addressrange | CIDR] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination address [address | addressrange | CIDR] - - Match based on source or destination address. This is similar to network - groups, but you can negate the matching addresses here. - - .. code-block:: none - - set firewall ipv6 name FOO rule 100 source address 2001:db8::202 -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination address-mask [address] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination address-mask [address] - - Apply an arbitrary netmask to mask addresses and match only a specific - portion. This is useful for IPv6 because rules remain valid when the IPv6 - prefix changes if the host portion of the system's IPv6 address is static. - Examples include SLAAC and `tokenised IPv6 addresses - `_ - - This function works for both individual addresses and address groups. - - .. stop_vyoslinter - .. code-block:: none - - # Match any IPv6 address with the suffix ::0000:0000:0000:beef - set firewall ipv6 forward filter rule 100 destination address ::beef - set firewall ipv6 forward filter rule 100 destination address-mask ::ffff:ffff:ffff:ffff - # Address groups - set firewall group ipv6-address-group WEBSERVERS address ::1000 - set firewall group ipv6-address-group WEBSERVERS address ::2000 - set firewall ipv6 forward filter rule 200 source group address-group WEBSERVERS - set firewall ipv6 forward filter rule 200 source address-mask ::ffff:ffff:ffff:ffff - - .. start_vyoslinter -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination fqdn -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination fqdn - - Specify a Fully Qualified Domain Name as source or destination to match. - Ensure that the router can resolve the DNS query. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination geoip country-code -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination geoip inverse-match -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination geoip inverse-match - - Match IP addresses based on their geolocation. For more information, see - `GeoIP matching `_. Use inverse-match to match anything except the specified - country codes. -``` - -DB-IP.com provides data under CC-BY-4.0 license. Attribution is required and -redistribution is permitted, allowing VyOS to include a database in images -(approximately 3 MB compressed). The package includes a cron script that you -can manually call through op-mode update geoip to keep the database and rules -updated. - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source mac-address -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source mac-address -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source mac-address -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source mac-address - - You can specify only a source MAC address to match. - - .. code-block:: none - - set firewall ipv6 input filter rule 100 source mac-address 00:53:00:11:22:33 - set firewall ipv6 input filter rule 101 source mac-address !00:53:00:aa:12:34 -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination port [1-65535 | portname | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination port [1-65535 | portname | start-end] - - Specify a port by number or by name as defined in ``/etc/services``. - - .. code-block:: none - - set firewall ipv6 forward filter rule 10 source port '22' - set firewall ipv6 forward filter rule 11 source port '!http' - set firewall ipv6 forward filter rule 12 source port 'https' - - Multiple source ports can be specified as a comma-separated list. - The whole list can also be "negated" using ``!``. For example: - - .. code-block:: none - - set firewall ipv6 forward filter rule 10 source port '!22,https,3333-3338' -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group address-group - - Specify an address group. You can prepend the character ``!`` to invert the - matching criteria. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group dynamic-address-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group dynamic-address-group - - Specify a dynamic address group. You can prepend the character ``!`` to - invert the matching criteria. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group network-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group network-group - - Specify a network group. You can prepend the character ``!`` to invert the - matching criteria. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group port-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group port-group - - Specify a port group. You can prepend the character ``!`` to invert the - matching criteria. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group domain-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group domain-group - - Specify a domain group. You can prepend the character ``!`` to invert the - matching criteria. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - source group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - source group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - source group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - source group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - destination group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - destination group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - destination group mac-group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - destination group mac-group - - Specify a MAC group. You can prepend the character ``!`` to invert the - matching criteria. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - dscp [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - dscp [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - dscp [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - dscp [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - dscp-exclude [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - dscp-exclude [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - dscp-exclude [0-63 | start-end] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - dscp-exclude [0-63 | start-end] - - Match based on dscp value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - fragment [match-frag | match-non-frag] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - fragment [match-frag | match-non-frag] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - fragment [match-frag | match-non-frag] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - fragment [match-frag | match-non-frag] - - Match packets based on fragmentation. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - icmpv6 [code | type] <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - icmpv6 [code | type] <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - icmpv6 [code | type] <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - icmpv6 [code | type] <0-255> - - Match packets based on ICMP or ICMPv6 code and type. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - icmpv6 type-name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - icmpv6 type-name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - icmpv6 type-name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - icmpv6 type-name - - Match based on ICMPv6 type-name. Press **Tab** for information about - supported **type-name** criteria. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - inbound-interface name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - inbound-interface name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - inbound-interface name - - Match based on inbound interface. You can use the wildcard ``*``. For - example: ``eth2*``. You can prepend the character ``!`` to invert the - matching criteria. For example ``!eth2`` -``` - -:::{note} -If an interface is attached to a non-default VRF, when using -**inbound-interface**, use the VRF name. For example: -`set firewall ipv6 forward filter rule 10 inbound-interface name MGMT` -::: - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - inbound-interface group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - inbound-interface group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - inbound-interface group - - Match based on the inbound interface group. You can prepend the character - ``!`` to invert the matching criteria. For example ``!IFACE_GROUP`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - outbound-interface name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - outbound-interface name -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - outbound-interface name - - Match based on outbound interface. You can use the wildcard ``*``. For - example: ``eth2*``. You can prepend the character ``!`` to invert the - matching criteria. For example ``!eth2`` -``` - -:::{note} -If an interface is attached to a non-default VRF, when using -**outbound-interface**, use the physical interface name. For example: -`set firewall ipv6 forward filter rule 10 outbound-interface name eth0` -::: - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - outbound-interface group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - outbound-interface group -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - outbound-interface group - - Match based on outbound interface group. You can prepend the character ``!`` - to invert the matching criteria. For example ``!IFACE_GROUP`` -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - ipsec [match-ipsec-in | match-none-in] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - ipsec [match-ipsec-out | match-none-out] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - ipsec [match-ipsec-in | match-ipsec-out | match-none-in | match-none-out] - - Match packets based on IPsec. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - limit burst <0-4294967295> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - limit burst <0-4294967295> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - limit burst <0-4294967295> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - limit burst <0-4294967295> - - Match based on the maximum number of packets allowed to exceed the rate - limit. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - limit rate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - limit rate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - limit rate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - limit rate - - Match based on the maximum average rate, specified as ``integer/unit``. - For example, specify ``5/minutes``. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - packet-length -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - packet-length -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - packet-length -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - packet-length -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - packet-length-exclude -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - packet-length-exclude -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - packet-length-exclude -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - packet-length-exclude - - Match based on packet length. You can specify multiple values from 1 to - 65535 and ranges. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - packet-type [broadcast | host | multicast | other] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - packet-type [broadcast | host | multicast | other] - - Match based on packet type. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - protocol [ | <0-255> | all | tcp_udp] - - Match based on protocol number or name as defined in ``/etc/protocols``. - Specify ``all`` for all protocols and ``tcp_udp`` for TCP and UDP packets. - Prepend ``!`` to negate the protocol selection. - - .. code-block:: none - - set firewall ipv6 input filter rule 10 protocol tcp -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - recent time [second | minute | hour] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - recent time [second | minute | hour] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - recent time [second | minute | hour] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - recent time [second | minute | hour] - - Match packets based on recently seen sources. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - tcp flags [not] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - tcp flags [not] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - tcp flags [not] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - tcp flags [not] - - Allowed values for TCP flags: ``ack``, ``cwr``, ``ecn``, ``fin``, ``psh``, - ``rst``, ``syn``, and ``urg``. You can specify multiple values. To invert - the selection, use ``not``, as shown in the following example. - - .. code-block:: none - - set firewall ipv6 input filter rule 10 tcp flags 'ack' - set firewall ipv6 input filter rule 12 tcp flags 'syn' - set firewall ipv6 input filter rule 13 tcp flags not 'fin' -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - state [established | invalid | new | related] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - state [established | invalid | new | related] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - state [established | invalid | new | related] -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - state [established | invalid | new | related] - - Match based on packet state. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time startdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time startdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time startdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time startdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time starttime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time starttime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time starttime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time starttime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time stopdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time stopdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time stopdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time stopdate -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time stoptime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time stoptime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time stoptime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time stoptime -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - time weekdays -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - time weekdays -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - time weekdays -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - time weekdays - - Match packets based on time criteria. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - hop-limit <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - hop-limit <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - hop-limit <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - hop-limit <0-255> - - Match the hop-limit parameter. Use ``eq`` for equal, ``gt`` for greater than, - and ``lt`` for less than. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - recent count <1-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - recent time -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 input filter rule <1-999999> - recent time -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output filter rule <1-999999> - recent time -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 name rule <1-999999> - recent time - - Match when the specified number of connections occur within the specified - time period. Use these criteria to block brute-force attempts. -``` - -### Packet Modifications - -The firewall can modify packets before sending them. -This feature provides more flexibility for packet handling. - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> - set dscp <0-63> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set dscp <0-63> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set dscp <0-63> - - Set a specific value of Differentiated Services Codepoint (DSCP). -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> - set mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set mark <1-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set mark <1-2147483647> - - Set a specific packet mark value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> - set tcp-mss <500-1460> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set tcp-mss <500-1460> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set tcp-mss <500-1460> - - Set the TCP-MSS (TCP maximum segment size) for the connection. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 prerouting raw rule <1-999999> - set hop-limit <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set hop-limit <0-255> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set hop-limit <0-255> - - Set hop limit value. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 forward filter rule <1-999999> - set connection-mark <0-2147483647> -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 output [filter | raw] rule <1-999999> - set connection-mark <0-2147483647> - - Set connection mark value. -``` - -## Synproxy - -Synproxy connections - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> - action synproxy -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> - protocol tcp -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> - synproxy tcp mss <501-65535> - - Set the TCP MSS (maximum segment size) for the connection. -``` - -```{eval-rst} -.. cfgcmd:: set firewall ipv6 [input | forward] filter rule <1-999999> - synproxy tcp window-scale <1-14> - - Set the window scale factor for TCP window scaling. -``` - -### Example synproxy - -Requirements to enable synproxy: - -> - Traffic must be symmetric -> - Synproxy relies on syncookies and TCP timestamps, ensure these are enabled -> - Disable conntrack loose track option - -```none -set system sysctl parameter net.ipv4.tcp_timestamps value '1' - -set system conntrack tcp loose disable -set system conntrack ignore ipv6 rule 10 destination port '8080' -set system conntrack ignore ipv6 rule 10 protocol 'tcp' -set system conntrack ignore ipv6 rule 10 tcp flags syn - -set firewall global-options syn-cookies 'enable' -set firewall ipv6 input filter rule 10 action 'synproxy' -set firewall ipv6 input filter rule 10 destination port '8080' -set firewall ipv6 input filter rule 10 inbound-interface name 'eth1' -set firewall ipv6 input filter rule 10 protocol 'tcp' -set firewall ipv6 input filter rule 10 synproxy tcp mss '1460' -set firewall ipv6 input filter rule 10 synproxy tcp window-scale '7' -set firewall ipv6 input filter rule 1000 action 'drop' -set firewall ipv6 input filter rule 1000 state invalid -``` - -## Operation-mode Firewall - -### Rule-set overview - -```{eval-rst} -.. opcmd:: show firewall - - Show a basic firewall overview for all rule-sets, not only for IPv6: - - .. code-block:: none - - vyos@vyos:~$ show firewall - Rulesets Information - - --------------------------------- - IPv4 Firewall "forward filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ----------------------------------------- - 5 jump all 0 0 iifname "eth1" jump NAME_VyOS_MANAGEMENT - 10 jump all 0 0 oifname "eth1" jump NAME_WAN_IN - 15 jump all 0 0 iifname "eth3" jump NAME_WAN_IN - default accept all - - --------------------------------- - IPv4 Firewall "name VyOS_MANAGEMENT" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- -------------------------------- - 5 accept all 0 0 ct state established accept - 10 drop all 0 0 ct state invalid - 20 accept all 0 0 ip saddr @A_GOOD_GUYS accept - 30 accept all 0 0 ip saddr @N_ENTIRE_RANGE accept - 40 accept all 0 0 ip saddr @A_VyOS_SERVERS accept - 50 accept icmp 0 0 meta l4proto icmp accept - default drop all 0 0 - - --------------------------------- - IPv6 Firewall "forward filter" - - Rule Action Protocol - ------- -------- ---------- - 5 jump all - 10 jump all - 15 jump all - default accept all - - --------------------------------- - IPv6 Firewall "input filter" - - Rule Action Protocol - ------- -------- ---------- - 5 jump all - default accept all - - --------------------------------- - IPv6 Firewall "ipv6_name IPV6-VyOS_MANAGEMENT" - - Rule Action Protocol - ------- -------- ---------- - 5 accept all - 10 drop all - 20 accept all - 30 accept all - 40 accept all - 50 accept ipv6-icmp - default drop all -``` - -```{eval-rst} -.. opcmd:: show firewall summary - - This will show you a summary of rule-sets and groups - - .. code-block:: none - - vyos@vyos:~$ show firewall summary - Ruleset Summary - - IPv6 Ruleset: - - Ruleset Hook Ruleset Priority Description - -------------- -------------------- ------------------------- - forward filter - input filter - ipv6_name IPV6-VyOS_MANAGEMENT - ipv6_name IPV6-WAN_IN PUBLIC_INTERNET - - IPv4 Ruleset: - - Ruleset Hook Ruleset Priority Description - -------------- ------------------ ------------------------- - forward filter - input filter - name VyOS_MANAGEMENT - name WAN_IN PUBLIC_INTERNET - - Firewall Groups - - Name Type References Members - ----------------------- ------------------ ----------------------- ---------------- - PBX address_group WAN_IN-100 198.51.100.77 - SERVERS address_group WAN_IN-110 192.0.2.10 - WAN_IN-111 192.0.2.11 - WAN_IN-112 192.0.2.12 - WAN_IN-120 - WAN_IN-121 - WAN_IN-122 - SUPPORT address_group VyOS_MANAGEMENT-20 192.168.1.2 - WAN_IN-20 - PHONE_VPN_SERVERS address_group WAN_IN-160 10.6.32.2 - PINGABLE_ADRESSES address_group WAN_IN-170 192.168.5.2 - WAN_IN-171 - PBX ipv6_address_group IPV6-WAN_IN-100 2001:db8::1 - SERVERS ipv6_address_group IPV6-WAN_IN-110 2001:db8::2 - IPV6-WAN_IN-111 2001:db8::3 - IPV6-WAN_IN-112 2001:db8::4 - IPV6-WAN_IN-120 - IPV6-WAN_IN-121 - IPV6-WAN_IN-122 - SUPPORT ipv6_address_group IPV6-VyOS_MANAGEMENT-20 2001:db8::5 - IPV6-WAN_IN-20 - -``` - -```{eval-rst} -.. opcmd:: show firewall ipv6 [forward | input | output] filter -``` - -```{eval-rst} -.. opcmd:: show firewall ipv6 ipv6-name - - This command will give an overview of a single rule-set. - - .. code-block:: none - - vyos@vyos:~$ show firewall ipv6 input filter - Ruleset Information - - --------------------------------- - ipv6 Firewall "input filter" - - Rule Action Protocol Packets Bytes Conditions - ------- -------- ---------- --------- ------- ------------------------------------------------------------------------------ - 10 jump all 13 1456 iifname "eth1" jump NAME6_INP-ETH1 - 20 accept ipv6-icmp 10 1112 meta l4proto ipv6-icmp iifname "eth0" prefix "[ipv6-INP-filter-20-A]" accept - default accept all 14 1584 - - vyos@vyos:~$ -``` - -```{eval-rst} -.. opcmd:: show firewall ipv6 [forward | input | output] - filter rule <1-999999> -``` - -```{eval-rst} -.. opcmd:: show firewall ipv6 name rule <1-999999> -``` - -```{eval-rst} -.. opcmd:: show firewall ipv6 ipv6-name rule <1-999999> - - This command will give an overview of a rule in a single rule-set -``` - -```{eval-rst} -.. opcmd:: show firewall group - - Show an overview of defined groups, including the type, members, and where - the group is used. - - .. code-block:: none - - vyos@vyos:~$ show firewall group LAN - Firewall Groups - - Name Type References Members - ------------ ------------------ ----------------------- ---------------- - LAN ipv6_network_group IPV6-VyOS_MANAGEMENT-30 2001:db8::0/64 - IPV6-WAN_IN-30 - LAN network_group VyOS_MANAGEMENT-30 192.168.200.0/24 - WAN_IN-30 - -``` - -```{eval-rst} -.. opcmd:: show firewall statistics - - Show statistics of all rule-sets since the last boot. -``` - -### Show Firewall log - -```{eval-rst} -.. opcmd:: show log firewall -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv6 -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv6 [forward | input | output | name] -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv6 [forward | input | output] filter -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv6 name -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv6 [forward | input | output] filter rule -``` - -```{eval-rst} -.. opcmd:: show log firewall ipv6 name rule - - Show firewall logs for all firewalls, all IPv6 firewalls, specific hooks, - specific priorities, specific custom chains, or specific rule-sets. -``` - -### Example Partial Config - -```none -firewall { - ipv6 { - input { - filter { - rule 10 { - action jump - inbound-interface { - name eth1 - } - jump-target INP-ETH1 - } - rule 20 { - action accept - inbound-interface { - name eth0 - } - log - protocol ipv6-icmp - } - } - } - name INP-ETH1 { - default-action drop - default-log - rule 10 { - action accept - protocol tcp_udp - } - } - } -} -``` - -### Update geoip database - -```{eval-rst} -.. opcmd:: update geoip - - Command used to update GeoIP database and firewall sets. -``` diff --git a/docs/configuration/firewall/md-zone.md b/docs/configuration/firewall/md-zone.md deleted file mode 100644 index 948c5b43..00000000 --- a/docs/configuration/firewall/md-zone.md +++ /dev/null @@ -1,221 +0,0 @@ ---- -lastproofread: '2026-03-30' ---- - -(firewall-zone)= - -# Zone-Based Firewall - -## Overview - -:::{note} -All VyOS versions built after 2023-10-22 (VyOS 1.4 and 1.5) support -this feature. -::: - -This section provides information on firewall configuration for the -zone-based firewall. This section covers the following configuration -commands: - -```{eval-rst} -.. cfgcmd:: set firewall zone ... -``` - -To learn about the general traffic flow in VyOS firewalls, -see {doc}`Firewall `. - -```none -- set firewall - * zone - - custom_zone_name - + ... -``` - -In zone-based policy, you assign interfaces to zones and apply inspection -policy to traffic moving between zones. The firewall acts on traffic -according to rules. A zone is a group of interfaces that have similar -functions or features. It establishes the security borders of a network. -A zone defines a boundary where the system subjects traffic to policy -restrictions as it crosses to another region of a network. - -Key Points: - -- A zone must be configured before you assign an interface to it, and you - can assign an interface to only a single zone. -- All traffic to and from an interface within a zone flows freely. -- Existing policies affect all traffic between zones. -- Traffic cannot flow between a zone member interface and any interface that - is not a zone member. -- You must define 2 separate firewalls to define traffic: one for each - direction. - -:::{note} -In {vytask}`T2199` the syntax of the zone configuration was changed. -The zone configuration moved from `zone-policy zone ` to `firewall -zone `. -::: - -## Configuration - -As an alternative to applying policy to an interface directly, you can -create a zone-based firewall to simplify configuration when multiple -interfaces belong to the same security zone. Instead of applying rule-sets -to interfaces, you apply them to source-destination zone pairs. - -You can find a basic introduction to zone-based firewalls in the -[VyOS Knowledge Base](https://support.vyos.io/en/kb/articles/a-primer-to-zone-based-firewall), -and an example at {ref}`examples-zone-policy`. - -The following steps are required to create a zone-based firewall: - -1. Define both the source and destination zones -2. Define the rule-set -3. Apply the rule-set to the zones - -### Define a Zone - -To define a zone, set up either one with interfaces or as the local zone. - -```{eval-rst} -.. cfgcmd:: set firewall zone interface - - Assign interfaces as a member of a zone. - - .. note:: - - * An interface can only be a member of one zone. - * You can have multiple interfaces in a zone. Traffic between - interfaces in the same zone follows the intra-zone-filtering - policy (allowed by default). -``` - -```{eval-rst} -.. cfgcmd:: set firewall zone local-zone - - Define the zone as the local zone for traffic that originates from or is - destined to the router itself. - - .. note:: - - * A local zone cannot have any member interfaces - * You cannot have multiple local zones -``` - -```{eval-rst} -.. cfgcmd:: set firewall zone default-action [drop | reject] - - Modify the zone default-action, which applies to traffic destined to this - zone that does not match any of the source zone rulesets applied. -``` - -```{eval-rst} -.. cfgcmd:: set firewall zone default-log - - Enable logging of packets that match this zone's default-action (disabled - by default). -``` - -```{eval-rst} -.. cfgcmd:: set firewall zone description - - Add a meaningful description. -``` - -### Defining a Rule-Set - -Zone-based firewall rule-sets define traffic from a *Source Zone* to a -*Destination Zone*. - -You create rule-sets as a custom firewall chain using the commands below -(refer to the firewall IPv4/IPv6 sections for the full syntax): - -- For {ref}`IPv4`: - `set firewall ipv4 name ...` -- For {ref}`IPv6`: - `set firewall ipv6 name ...` - -It is helpful to name the rule-sets in the format -`--` to make them easily -identifiable. - -### Applying a Rule-Set to a Zone - -After you define a rule-set, apply it to the source and destination zones. -The configuration syntax anchors to the destination zone, with each of the -source zone rule-sets listed against the destination. - -```{eval-rst} -.. cfgcmd:: set firewall zone from - firewall name -``` - -```{eval-rst} -.. cfgcmd:: set firewall zone from - firewall ipv6-name -``` - -You should create two rule-sets for each source-destination zone -pair. - -```none -set firewall zone DMZ from LAN firewall name LAN-DMZ-v4 -set firewall zone LAN from DMZ firewall name DMZ-LAN-v4 -``` - -### Applying a Default Rule-Set to a Zone - -When a destination zone shares a common rule-set for multiple source zones, -or when you require a complex set of default policies, you can apply an -optional default rule-set. The default rule-set applies to all zones that do -not have a rule-set configured as defined in -{ref}`IPv4` - -```{eval-rst} -.. cfgcmd:: set firewall zone default-firewall name - -``` - -```{eval-rst} -.. cfgcmd:: set firewall zone default-firewall ipv6-name - -``` - -## Operation-mode - -```{eval-rst} -.. opcmd:: show firewall zone-policy - - Display a basic summary of the zone configuration. - - .. code-block:: none - - vyos@vyos:~$ show firewall zone-policy - Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 - ------ ------------ ----------- --------------- --------------- - LAN eth1 WAN WAN-LAN-v4 - eth2 - LOCAL LOCAL LAN LAN-LOCAL-v4 - WAN WAN-LOCAL-v4 WAN-LOCAL-v6 - WAN eth3 LAN LAN-WAN-v4 - eth0 LOCAL LOCAL-WAN-v4 -``` - -```{eval-rst} -.. opcmd:: show firewall zone-policy zone - - Display a basic summary of a particular zone. - - .. code-block:: none - - vyos@vyos:~$ show firewall zone-policy zone WAN - Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 - ------ ------------ ----------- --------------- --------------- - WAN eth3 LAN LAN-WAN-v4 - eth0 LOCAL LOCAL-WAN-v4 - - vyos@vyos:~$ show firewall zone-policy zone LOCAL - Zone Interfaces From Zone Firewall IPv4 Firewall IPv6 - ------ ------------ ----------- --------------- --------------- - LOCAL LOCAL LAN LAN-LOCAL-v4 - WAN WAN-LOCAL-v4 WAN-LOCAL-v6 -``` diff --git a/docs/configuration/highavailability/md-index.md b/docs/configuration/highavailability/md-index.md deleted file mode 100644 index d5d8f390..00000000 --- a/docs/configuration/highavailability/md-index.md +++ /dev/null @@ -1,527 +0,0 @@ ---- -lastproofread: '2021-06-30' ---- - -(high-availability)= - -# High availability - -VRRP (Virtual Router Redundancy Protocol) provides active/backup redundancy for -routers. Every VRRP router has a physical IP/IPv6 address, and a virtual -address. On startup, routers elect the master, and the router with the highest -priority becomes the master and assigns the virtual address to its interface. -All routers with lower priorities become backup routers. The master then starts -sending keepalive packets to notify other routers that it's available. If the -master fails and stops sending keepalive packets, the router with the next -highest priority becomes the new master and takes over the virtual address. - -VRRP keepalive packets use multicast, and VRRP setups are limited to a single -datalink layer segment. You can setup multiple VRRP groups -(also called virtual routers). Virtual routers are identified by a -VRID (Virtual Router IDentifier). If you setup multiple groups on the same -interface, their VRIDs must be unique if they use the same address family, -but it's possible (even if not recommended for readability reasons) to use -duplicate VRIDs on different interfaces. - -## Basic setup - -VRRP groups are created with the -`set high-availability vrrp group $GROUP_NAME` commands. The required -parameters are interface, vrid, and address. - -minimal config - -```none -set high-availability vrrp group Foo vrid 10 -set high-availability vrrp group Foo interface eth0 -set high-availability vrrp group Foo address 192.0.2.1/24 -``` - -You can verify your VRRP group status with the operational mode -`run show vrrp` command: - -```none -vyos@vyos# run show vrrp -Name Interface VRID State Last Transition ----------- ----------- ------ ------- ----------------- -Foo eth1 10 MASTER 2s -``` - -## IPv6 support - -The `address` parameter can be either an IPv4 or IPv6 address, but you can -not mix IPv4 and IPv6 in the same group, and will need to create groups with -different VRIDs specially for IPv4 and IPv6. -If you want to use IPv4 + IPv6 address you can use option `excluded-address` - -## Address - -The `address` can be configured either on the VRRP interface or on not VRRP -interface. - -```none -set high-availability vrrp group Foo address 192.0.2.1/24 -set high-availability vrrp group Foo address 203.0.113.22/24 interface eth2 -set high-availability vrrp group Foo address 198.51.100.33/24 interface eth3 -``` - -## Disabling a VRRP group - -You can disable a VRRP group with `disable` option: - -```none -set high-availability vrrp group Foo disable -``` - -A disabled group will be removed from the VRRP process and your router will not -participate in VRRP for that VRID. It will disappear from operational mode -commands output, rather than enter the backup state. - -## Exclude address - -Exclude IP addresses from `VRRP packets`. This option `excluded-address` is -used when you want to set IPv4 + IPv6 addresses on the same virtual interface -or when used more than 20 IP addresses. - -```none -set high-availability vrrp group Foo excluded-address '203.0.113.254/24' -set high-availability vrrp group Foo excluded-address '2001:db8:aa::1/64' -set high-availability vrrp group Foo excluded-address '2001:db8:22::1/64' -``` - -## Setting VRRP group priority - -VRRP priority can be set with `priority` option: - -```none -set high-availability vrrp group Foo priority 200 -``` - -The priority must be an integer number from 1 to 255. Higher priority value -increases router's precedence in the master elections. - -## Sync groups - -A sync group allows VRRP groups to transition together. - -```none -edit high-availability vrrp -set sync-group MAIN member VLAN9 -set sync-group MAIN member VLAN20 -``` - -In the following example, when VLAN9 transitions, VLAN20 will also transition: - -```none -vrrp { - group VLAN9 { - interface eth0.9 - address 10.9.1.1/24 - priority 200 - vrid 9 - } - group VLAN20 { - interface eth0.20 - priority 200 - address 10.20.20.1/24 - vrid 20 - } - sync-group MAIN { - member VLAN20 - member VLAN9 - } -} -``` - -:::{warning} -All items in a sync group should be similarly configured. -If one VRRP group is set to a different preemption delay or priority, -it would result in an endless transition loop. -::: - -## Preemption - -VRRP can use two modes: preemptive and non-preemptive. In the preemptive mode, -if a router with a higher priority fails and then comes back, routers with lower -priority will give up their master status. In non-preemptive mode, the newly -elected master will keep the master status and the virtual address indefinitely. - -By default VRRP uses preemption. You can disable it with the "no-preempt" -option: - -```none -set high-availability vrrp group Foo no-preempt -``` - -You can also configure the time interval for preemption with the "preempt-delay" -option. For example, to set the higher priority router to take over in 180 -seconds, use: - -```none -set high-availability vrrp group Foo preempt-delay 180 -``` - -## Track - -Track option to track non VRRP interface states. VRRP changes status to -`FAULT` if one of the track interfaces in state `down`. - -```none -set high-availability vrrp group Foo track interface eth0 -set high-availability vrrp group Foo track interface eth1 -``` - -Ignore VRRP main interface faults - -```none -set high-availability vrrp group Foo track exclude-vrrp-interface -``` - -## Unicast VRRP - -By default VRRP uses multicast packets. If your network does not support -multicast for whatever reason, you can make VRRP use unicast communication -instead. - -```none -set high-availability vrrp group Foo peer-address 192.0.2.10 -set high-availability vrrp group Foo hello-source-address 192.0.2.15 -``` - -## rfc3768-compatibility - -RFC 3768 defines a virtual MAC address to each VRRP virtual router. -This virtual router MAC address will be used as the source in all periodic VRRP -messages sent by the active node. When the rfc3768-compatibility option is set, -a new VRRP interface is created, to which the MAC address and the virtual IP -address is automatically assigned. - -```none -set high-availability vrrp group Foo rfc3768-compatibility -``` - -Verification - -```none -$show interfaces ethernet eth0v10 -eth0v10@eth0: mtu 1500 qdisc noqueue -state UP group default qlen 1000 -link/ether 00:00:5e:00:01:0a brd ff:ff:ff:ff:ff:ff -inet 172.25.0.247/16 scope global eth0v10 -valid_lft forever preferred_lft forever -``` - -:::{warning} -RFC 3768 creates a virtual interface. If you want to apply -the destination NAT rule to the traffic sent to the virtual MAC, set -the created virtual interface as `inbound-interface`. -::: - -## Global options - -On most scenarios, there's no need to change specific parameters, and using -default configuration is enough. But there are cases were extra configuration -is needed. - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp global-parameters startup_delay <1-600> - - This option specifies a delay in seconds before vrrp instances start up - after keepalived starts. -``` - -## Gratuitous ARP - -These configuration is not mandatory and in most cases there's no -need to configure it. But if necessary, Gratuitous ARP can be configured in -`global-parameters` and/or in `group` section. - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp global-parameters garp interval - <0.000-1000> -``` - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp group garp interval <0.000-1000> - - Set delay between gratuitous ARP messages sent on an interface. - - 0 if not defined. -``` - - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp global-parameters garp master-delay <1-255> -``` - - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp group garp master-delay <1-255> - - Set delay for second set of gratuitous ARPs after transition to MASTER. - - 5 if not defined. -``` - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp global-parameters garp master-refresh - <1-600> -``` - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp group garp master-refresh - <1-600> - - Set minimum time interval for refreshing gratuitous ARPs while MASTER. - - 0 if not defined, which means no refreshing. -``` - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp global-parameters garp - master-refresh-repeat <1-600> -``` - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp group garp - master-refresh-repeat <1-600> - - Set number of gratuitous ARP messages to send at a time while MASTER. - - 1 if not defined. -``` - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp global-parameters garp master-repeat - <1-600> -``` - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp group garp master-repeat - <1-600> - - Set number of gratuitous ARP messages to send at a time after transition to - MASTER. - - 5 if not defined. -``` - -## Version - -```{eval-rst} -.. cfgcmd:: set high-availability vrrp global-parameters version 2|3 - - Set the default VRRP version to use. This defaults to 2, but IPv6 instances - will always use version 3. -``` - -## Scripting - -VRRP functionality can be extended with scripts. VyOS supports two kinds of -scripts: health check scripts and transition scripts. Health check scripts -execute custom checks in addition to the master router reachability. Transition -scripts are executed when VRRP state changes from master to backup or fault and -vice versa and can be used to enable or disable certain services, for example. - -:::{note} -Simply placing script files in `/config/scripts/` does not mean the -system can execute them. To make custom scripts executable, grant them -**execute permissions**. Use the following command: - -```none -chmod +x /config/scripts/script-name.sh -``` -::: - -:::{warning} -It is not recommended to change VRRP configuration -inside health-check and transition scripts. -::: - -### Health check scripts - -There is the ability to run an arbitrary script at regular intervals -according to health-check parameters. If a script returns 0, it -indicates success. If a script returns anything else, it will indicate -that the VRRP instance should enter the FAULT state. - -This setup will make the VRRP process execute the -`/config/scripts/vrrp-check.sh script` every 60 seconds, and transition the -group to the fault state if it fails (i.e. exits with non-zero status) three -times: - - -```none -set high-availability vrrp group Foo health-check script /config/scripts/vrrp-check.sh -set high-availability vrrp group Foo health-check interval 60 -set high-availability vrrp group Foo health-check failure-count 3 -``` - - -When the vrrp group is a member of the sync group will use only -the sync group health check script. -This example shows how to configure it for the sync group: - - -```none -set high-availability vrrp sync-group Bar health-check script /config/scripts/vrrp-check.sh -set high-availability vrrp sync-group Bar health-check interval 60 -set high-availability vrrp sync-group Bar health-check failure-count 3 -``` - - -### Transition scripts - -Transition scripts can help you implement various fixups, such as starting and -stopping services, or even modifying the VyOS config on VRRP transition. -This setup will make the VRRP process execute the -`/config/scripts/vrrp-fail.sh` with argument `Foo` when VRRP fails, -and the `/config/scripts/vrrp-master.sh` when the router becomes the master: - - -```none -set high-availability vrrp group Foo transition-script backup "/config/scripts/vrrp-fail.sh Foo" -set high-availability vrrp group Foo transition-script fault "/config/scripts/vrrp-fail.sh Foo" -set high-availability vrrp group Foo transition-script master "/config/scripts/vrrp-master.sh Foo" -``` - - -To know more about scripting, check the {ref}`command-scripting` section. - -## Virtual-server - -```{include} /_include/need_improvement.txt -``` - -Virtual Server allows to Load-balance traffic destination virtual-address:port -between several real servers. - -### Algorithm - -Load-balancing schedule algorithm: - -- round-robin -- weighted-round-robin -- least-connection -- weighted-least-connection -- source-hashing -- destination-hashing -- locality-based-least-connection - -```none -set high-availability virtual-server 203.0.113.1 algorithm 'least-connection' -``` - -### Forward method - -- NAT -- direct -- tunnel - -```none -set high-availability virtual-server 203.0.113.1 forward-method 'nat' -``` - -### Health-check - -Custom health-check script allows checking real-server availability - - -```none -set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 health-check script -``` - - -### Fwmark - -Firewall mark. It possible to loadbalancing traffic based on `fwmark` value - -```none -set high-availability virtual-server 203.0.113.1 fwmark '111' -``` - -### Real server - -Real server IP address and port - - -```none -set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '80' -``` - - -### Example - -Virtual-server can be configured with VRRP virtual address or without VRRP. - -In the next example all traffic destined to `203.0.113.1` and port `8280` -protocol TCP is balanced between 2 real servers `192.0.2.11` and -`192.0.2.12` to port `80` - -Real server is auto-excluded if port check with this server fail. - - -```none -set interfaces ethernet eth0 address '203.0.113.11/24' -set interfaces ethernet eth1 address '192.0.2.1/24' -set high-availability vrrp group FOO interface 'eth0' -set high-availability vrrp group FOO no-preempt -set high-availability vrrp group FOO priority '150' -set high-availability vrrp group FOO address '203.0.113.1/24' -set high-availability vrrp group FOO vrid '10' - -set high-availability virtual-server 203.0.113.1 algorithm 'source-hashing' -set high-availability virtual-server 203.0.113.1 delay-loop '10' -set high-availability virtual-server 203.0.113.1 forward-method 'nat' -set high-availability virtual-server 203.0.113.1 persistence-timeout '180' -set high-availability virtual-server 203.0.113.1 port '8280' -set high-availability virtual-server 203.0.113.1 protocol 'tcp' -set high-availability virtual-server 203.0.113.1 real-server 192.0.2.11 port '80' -set high-availability virtual-server 203.0.113.1 real-server 192.0.2.12 port '80' -``` - - -A firewall mark `fwmark` allows using multiple ports for high-availability -virtual-server. -It uses fwmark value. - -In this example all traffic destined to ports "80, 2222, 8888" protocol TCP -marks to fwmark "111" and balanced between 2 real servers. -Port "0" is required if multiple ports are used. - - -```none -set interfaces ethernet eth0 address 'dhcp' -set interfaces ethernet eth0 description 'WAN' -set interfaces ethernet eth1 address '192.0.2.1/24' -set interfaces ethernet eth1 description 'LAN' - -set policy route PR interface 'eth0' -set policy route PR rule 10 destination port '80,2222,8888' -set policy route PR rule 10 protocol 'tcp' -set policy route PR rule 10 set mark '111' - -set high-availability virtual-server vyos fwmark '111' -set high-availability virtual-server vyos protocol 'tcp' -set high-availability virtual-server vyos real-server 192.0.2.11 health-check script '/config/scripts/check-real-server-first.sh' -set high-availability virtual-server vyos real-server 192.0.2.11 port '0' -set high-availability virtual-server vyos real-server 192.0.2.12 health-check script '/config/scripts/check-real-server-second.sh' -set high-availability virtual-server vyos real-server 192.0.2.12 port '0' - -set nat source rule 100 outbound-interface name 'eth0' -set nat source rule 100 source address '192.0.2.0/24' -set nat source rule 100 translation address 'masquerade' -``` - - -Op-mode check virtual-server status - -```none -vyos@r14:~$ run show virtual-server -IP Virtual Server version 1.2.1 (size=4096) -Prot LocalAddress:Port Scheduler Flags - -> RemoteAddress:Port Forward Weight ActiveConn InActConn -FWM 111 lc persistent 300 - -> 192.0.2.11:0 Masq 1 0 0 - -> 192.0.2.12:0 Masq 1 1 0 -``` diff --git a/docs/configuration/interfaces/md-bonding.md b/docs/configuration/interfaces/md-bonding.md deleted file mode 100644 index 4538b145..00000000 --- a/docs/configuration/interfaces/md-bonding.md +++ /dev/null @@ -1,753 +0,0 @@ ---- -lastproofread: '2025-12-09' ---- - -(bond-interface)= - -# Bond / link aggregation - -A **bonding interface** aggregates multiple network interfaces into a single -logical interface (referred to as a bond, {abbr}`LAG (Link Aggregation Group)`, -EtherChannel, or port-channel). - -The behavior of a bonding interface depends on the selected mode. Modes provide -either fault tolerance or a combination of load balancing and fault tolerance. -Additionally, the bonding interface can be configured for link integrity -monitoring. - -## Configuration - -### Common interface configuration - -```{eval-rst} -.. cmdincludemd:: /_include/interface-common-with-dhcp.txt - :var0: bonding - :var1: bond0 -``` - -### Member interfaces - -```{eval-rst} -.. cfgcmd:: set interfaces bonding member interface - - **Add an interface to the bonding group.** - - **Example:** - - To configure eth0 and eth1 as members of the bonding interface bond0, execute - the following commands: -``` - -```none -set interfaces bonding bond0 member interface eth0 -set interfaces bonding bond0 member interface eth1 -``` - -### Bond modes - -```{eval-rst} -.. cfgcmd:: set interfaces bonding mode <802.3ad | active-backup | - broadcast | round-robin | transmit-load-balance | adaptive-load-balance | - xor-hash> - - **Configure the bonding mode on the interface. The default mode is** - ``802.3ad``. - - The available modes are: - - * ``802.3ad`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - IEEE 802.3ad Dynamic Link Aggregation. Groups only member interfaces with - the same speed (e.g., 1 Gbps) and duplex settings. Member interfaces with - different speed and duplex settings are not included in the active bond. - - Provides load balancing and fault tolerance. Uses the {abbr}`LACP (Link - Aggregation Control Protocol)` to negotiate the bond with the switch. - * - **Traffic distribution:** - - Traffic is distributed according to the **transmit hash policy** - (default: XOR). - - The bonding driver applies an XOR operation to specific packet header fields, - generating a hash value that maps to a particular member interface. This - ensures the same network flow is consistently transmitted over the same member - interface. - - The transmit hash policy is configured via the ``hash-policy`` option. - * - **Failover:** - - If a member interface fails, the hash is recalculated to distribute - traffic among the remaining active member interfaces. - - .. note:: Not all transmit hash policies comply with 802.3ad, particularly - section 43.2.4. Using a non-compliant policy may result in out-of-order - packet delivery. - - * ``active-backup`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - Provides fault tolerance. Only one member interface is active at a time. - Other member interfaces remain in a standby mode. - * - **Traffic distribution:** - - All traffic (incoming and outgoing) is routed via one active member interface. - * - **Failover:** - - If the designated member interface fails, all traffic is routed to - another member interface. The bonding driver sends a Gratuitous ARP - to update the peer's MAC address table, linking the bond's MAC address - to another physical port. - - * ``broadcast`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - Provides maximum fault tolerance by duplicating traffic. - * - **Traffic distribution:** - - Every packet is duplicated and transmitted on **all** member interfaces. - * - **Failover:** - - Traffic flow is not interrupted as long as at least one member interface - remains active. - - * ``round-robin`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - Provides load balancing and fault tolerance. - * - **Traffic distribution:** - - Packets are transmitted in sequential order across the member interfaces - (e.g., packet 1 > interface A, packet 2 > interface B, etc.). - * - **Failover:** - - If a member interface fails, the sequence skips the failed interface and - continues with the remaining active members. - - * ``transmit-load-balance`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - Provides adaptive transmit load balancing and fault tolerance. - * - **Traffic distribution:** - - **Outgoing:** Distributed across all active member interfaces based on - the current load. - - **Incoming:** Received by a designated member interface (active receiver). - * - **Failover:** - - If the active receiver fails, another member interface takes over as the new - active receiver. - - * ``adaptive-load-balance`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - Provides adaptive transmit load balancing identical to - ``transmit-load-balance``, receive load balancing for IPv4 traffic, and fault - tolerance for both incoming and outgoing traffic. - * - **Traffic distribution:** - - **Outgoing:** Identical to ``transmit-load-balance``. - - **Incoming:** Distributed based on ARP manipulation. For both local and remote - connections, the bonding driver intercepts ARP traffic and changes the source - MAC address to the MAC address of the least loaded member interface. - - All traffic from that peer is then routed to the chosen member interface. - * - **Failover:** - - If a member interface's state changes (fails, recovers, is added, or excluded), - the traffic is redistributed among all active member interfaces. - - * ``xor-hash``: Provides load balancing and fault tolerance based on a hash formula. - Distributes traffic and handles failover identically to ``802.3ad``, but operates - without the {abbr}`LACP (Link Aggregation Control Protocol)`. -``` - -```{eval-rst} -.. cfgcmd:: set interfaces bonding min-links <0-16> - - **Configure how many member interfaces must be active (in the link-up state) to - mark the bonding interface UP (carrier asserted).** - - This command applies only when the bonding interface is configured in 802.3ad - mode and functions like the Cisco EtherChannel min-links feature. It ensures - that a bonding interface is marked UP (carrier asserted) only when a specified - number of member interfaces are active (in the link-up state). This helps - guarantee a minimum level of bandwidth for higher-level services (such as - clustering) relying on the bonding interface. - - The default value is 0. This marks the bonding interface UP (carrier asserted) - whenever an active LACP aggregator exists, regardless of the number of member - interfaces in that aggregator. - - .. note:: In 802.3ad mode, a bond cannot be active without at least one active - member interface. Therefore, setting min-links to 0 or 1 has the same result: - the bonding interface is marked UP (carrier asserted). -``` - -```{eval-rst} -.. cfgcmd:: set interfaces bonding lacp-rate - - **Configure the rate at which the bonding interface requests its link - partner to send** {abbr}`LACPDUs (Link Aggregation Control Protocol Data - Units)` **in 802.3ad mode.** - - This command applies only when the bonding interface is configured in - 802.3ad mode. - - The following options are available: - - * **slow (default):** Requests the link partner to transmit LACPDUs every 30 seconds. - - * **fast:** Requests the link partner to transmit LACPDUs every 1 second. - -``` - -```{eval-rst} -.. cfgcmd:: set interfaces bonding system-mac - - **Configure a specific MAC address for the bonding interface.** - - This sets the 802.3ad system MAC address, which is used for {abbr}`LACPDU (Link - Aggregation Control Protocol Data Unit)` exchanges with the link partner. - You can assign a fixed MAC address or generate a random one for these - {abbr}`LACPDU (Link Aggregation Control Protocol Data Unit)` exchanges. - -``` - -```{eval-rst} -.. cfgcmd:: set interfaces bonding hash-policy - - **Configure which transmit hash policy to use for distributing traffic across - member interfaces.** - - The following policies are available: - - * ``layer2`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - Routes all traffic destined for a specific network peer through the same - member interface. The policy is 802.3ad-compliant. - * - **Hash inputs:** - - Source MAC address, destination MAC address, and Ethernet packet type ID. - * - **Formula:** - - .. code-block:: none - - hash = source MAC address XOR destination MAC address XOR packet type ID - member interface number = hash modulo member interface count - - * ``layer2+3`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - Similar to ``layer2``, routes all traffic destined for a specific network - peer through the same member interface and is IEEE 802.3ad-compliant. Uses - both Layer 2 and Layer 3 information to provide a more balanced traffic distribution. - * - **Hash inputs:** - - * Source MAC address, destination MAC address, and Ethernet packet type ID. - * Source IP address, destination IP address. IPv6 addresses are first hashed - using ``IPv6_addr_hash``. - * - **Formula:** - - .. code-block:: none - - hash = source MAC address XOR destination MAC address XOR packet type ID - hash = hash XOR source IP address XOR destination IP address - hash = hash XOR (hash RSHIFT 16) - hash = hash XOR (hash RSHIFT 8) - member interface number = hash modulo member interface count - - For non-IP traffic, the formula is the same as for ``layer2``. - - * ``layer3+4`` - - .. list-table:: - :widths: 20 80 - - * - **Description:** - - Routes different connections (flows) destined for a specific network peer - through multiple member interfaces, but ensures each individual flow is - routed through only one member interface. - - .. note:: This policy is not fully 802.3ad-compliant. When a single TCP - or UDP flow contains both fragmented and unfragmented packets, the - algorithm may distribute them across different member interfaces. This - may result in out-of-order packet delivery, violating the 802.3ad standard. - * - **Hash inputs:** - - * Source port, destination port (if available). - * Source IP address, destination IP address. IPv6 addresses are first hashed - using ``IPv6_addr_hash``. - * - **Formula:** - - .. code-block:: none - - hash = source port, destination port (as in the header) - hash = hash XOR source IP address XOR destination IP address - hash = hash XOR (hash RSHIFT 16) - hash = hash XOR (hash RSHIFT 8) - member interface number = hash modulo member interface count - - For fragmented TCP or UDP packets and all other IPv4 and IPv6 traffic, the - source and destination port information is omitted. - - For non-IP traffic, the formula is the same as for ``layer2``. -``` - -```{eval-rst} -.. cfgcmd:: set interfaces bonding primary - - **Configure the primary member interface in the bond.** - - The primary member interface remains active as long as it is operational; - alternative member interfaces are used only if it fails. - - Use this configuration when a specific member interface is preferred, - such as one with higher throughput. - - This command applies only to ``active-backup``, ``transmit-load-balance``, and - ``adaptive-load-balance`` modes. -``` - -```{eval-rst} -.. cfgcmd:: set interfaces bonding arp-monitor interval