summaryrefslogtreecommitdiff
path: root/data/vyos-firewall-init.conf
blob: 3929edf0b57bb9ad2ef3a5430e4b24b5331351d0 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
#!/usr/sbin/nft -f

# Required by wanloadbalance
table ip nat {
    chain VYOS_PRE_SNAT_HOOK {
        type nat hook postrouting priority 99; policy accept;
        return
    }
}

table inet mangle {
    # Used by system flow-accounting
    chain FORWARD {
        type filter hook forward priority -150; policy accept;
    }
}

table raw {
    chain VYOS_TCP_MSS {
        type filter hook forward priority -300; policy accept;
    }

    chain vyos_global_rpfilter {
        return
    }

    chain vyos_rpfilter {
        type filter hook prerouting priority -300; policy accept;
        counter jump vyos_global_rpfilter
    }

    # Used by system flow-accounting
    chain VYOS_PREROUTING_HOOK {
        type filter hook prerouting priority -300; policy accept;
    }
}

table ip6 raw {
    chain VYOS_TCP_MSS {
        type filter hook forward priority -300; policy accept;
    }

    chain vyos_global_rpfilter {
        return
    }

    chain vyos_rpfilter {
        type filter hook prerouting priority -300; policy accept;
        counter jump vyos_global_rpfilter
    }

    # Used by system flow-accounting
    chain VYOS_PREROUTING_HOOK {
        type filter hook prerouting priority -300; policy accept;
    }
}

# Required by VRF
table inet vrf_zones {
    # Map of interfaces and connections tracking zones
    map ct_iface_map {
        typeof iifname : ct zone
    }
    # Assign unique zones for each VRF
    # Chain for inbound traffic
    chain vrf_zones_ct_in {
        type filter hook prerouting priority raw; policy accept;
    }
    # Chain for locally-generated traffic
    chain vrf_zones_ct_out {
        type filter hook output priority raw; policy accept;
    }
}