From 37ba454f746ab6c4b05fef520ced523e2ad032cb Mon Sep 17 00:00:00 2001 From: Gaige B Paulsen Date: Mon, 18 Nov 2024 07:33:49 -0500 Subject: T6882: fix: firewall global-options (#359) * T6882: fix: firewall global-options Updated a couple of RST files due to pre-commit * T6882: chore: update changelog * T6882: chore: update changelog * T6882: test: update tests to cover change --- docs/vyos.vyos.vyos_firewall_global_module.rst | 29 +- docs/vyos.vyos.vyos_firewall_rules_module.rst | 495 ++++++++++++++++++++++++- 2 files changed, 514 insertions(+), 10 deletions(-) (limited to 'docs') diff --git a/docs/vyos.vyos.vyos_firewall_global_module.rst b/docs/vyos.vyos.vyos_firewall_global_module.rst index a77ce80f..8c234afb 100644 --- a/docs/vyos.vyos.vyos_firewall_global_module.rst +++ b/docs/vyos.vyos.vyos_firewall_global_module.rst @@ -705,6 +705,33 @@ Parameters
Enable logging of packets part of an established connection.
+ + + + +
+ log_level + +
+ string +
+ + + + + +
Only available in 1.4+
+ + @@ -852,7 +879,6 @@ Examples - connection_type: established action: accept log: true - log_level: emer - connection_type: invalid action: reject route_redirects: @@ -898,7 +924,6 @@ Examples # "set firewall config-trap 'enable'", # "set firewall state-policy established action 'accept'", # "set firewall state-policy established log 'enable'", - # "set firewall state-policy established log-level 'emer'", # "set firewall state-policy invalid action 'reject'", # "set firewall broadcast-ping 'enable'", # "set firewall all-ping 'enable'", diff --git a/docs/vyos.vyos.vyos_firewall_rules_module.rst b/docs/vyos.vyos.vyos_firewall_rules_module.rst index b3d619be..ad363b4e 100644 --- a/docs/vyos.vyos.vyos_firewall_rules_module.rst +++ b/docs/vyos.vyos.vyos_firewall_rules_module.rst @@ -103,13 +103,33 @@ Parameters
  • drop
  • reject
  • accept
    • +
  • jump
    • Default action for rule-set.
    drop (Drop if no prior rules are hit (default))
    reject (Drop and notify source if no prior rules are hit)
    -
    accept (Accept if no prior rules are hit)
    +
    accept (Accept if no prior rules are hit) - jump (Jump to another rule-set, 1.4+)
    + + + + + + +
    + default_jump_target + +
    + string +
    + + + + +
    Default jump target if the default action is jump.
    +
    Only valid in 1.4 and later.
    +
    Only valid when default_action = jump.
    @@ -150,6 +170,29 @@ Parameters
    Option to log packets hitting default-action.
    + + + + +
    + filter + +
    + string +
    + + + + + +
    Filter type (exclusive to "name").
    +
    Supported in 1.4 and later.
    + + @@ -165,6 +208,7 @@ Parameters
    Firewall rule set name.
    +
    Required for 1.3- and optional for 1.4+.
    @@ -203,10 +247,17 @@ Parameters
  • reject
  • accept
  • inspect
    • +
  • continue
    • +
  • return
    • +
  • jump
    • +
  • queue
    • +
  • synproxy
    • Specifying the action.
    +
    inspect is available < 1.4
    +
    continue, return, jump, queue, synproxy are available >= 1.4
    @@ -389,6 +440,7 @@ Parameters
    Option to disable firewall rule.
    +
    aliased to disabled

    aliases: disabled
    @@ -532,6 +584,65 @@ Parameters + + + + + +
    + inbound_interface + +
    + dictionary +
    + + + + +
    Inbound interface.
    +
    Only valid in 1.4 and later.
    + + + + + + + + +
    + group + +
    + string +
    + + + + +
    Interface group.
    + + + + + + + + +
    + name + +
    + string +
    + + + + +
    Interface name.
    +
    Can have wildcards
    + + + @@ -546,10 +657,8 @@ Parameters -
    Option to log packets matching rule
    +
    Log matching packets.
    @@ -701,6 +830,65 @@ Parameters
    Rule number.
    + + + + + +
    + outbound_interface + +
    + dictionary +
    + + + + +
    Match outbound interface.
    +
    Only valid in 1.4 and later.
    + + + + + + + + +
    + group + +
    + string +
    + + + + +
    Interface group.
    + + + + + + + + +
    + name + +
    + string +
    + + + + +
    Interface name.
    +
    Can have wildcards
    + + + @@ -749,6 +937,112 @@ Parameters + + + + + +
    + packet_length + +
    + list + / elements=dictionary +
    + + + + +
    Packet length match.
    +
    Only valid in 1.4 and later.
    +
    Multiple values from 1 to 65535 and ranges are supported
    + + + + + + + + +
    + length + +
    + string +
    + + + + +
    Packet length or range.
    + + + + + + + + +
    + packet_length_exclude + +
    + list + / elements=dictionary +
    + + + + +
    Packet length match.
    +
    Only valid in 1.4 and later.
    +
    Multiple values from 1 to 65535 and ranges are supported
    + + + + + + + + +
    + length + +
    + string +
    + + + + +
    Packet length or range.
    + + + + + + + + +
    + packet_type + +
    + string +
    + + + + + +
    Packet type match.
    + + @@ -772,6 +1066,51 @@ Parameters
    (!)All IP protocols except for the specified name or number.
    + + + + + +
    + queue + +
    + string +
    + + + + +
    Queue options.
    +
    Only valid in 1.4 and later.
    +
    Only valid when action = queue.
    +
    Can be a queue number or range.
    + + + + + + + +
    + queue_options + +
    + string +
    + + + + + +
    Queue options.
    +
    Only valid in 1.4 and later.
    +
    Only valid when action = queue.
    + + @@ -819,13 +1158,14 @@ Parameters time
    - integer + string
    Source addresses seen in the last N seconds.
    +
    Since 1.4, this is a string of second/minute/hour
    @@ -869,6 +1209,26 @@ Parameters
    Source ip address subnet or range.
    + + + + + + +
    + fqdn + +
    + string +
    + + + + +
    Fully qualified domain name.
    +
    Available in 1.4 and later.
    + + @@ -1102,6 +1462,65 @@ Parameters + + + + + +
    + synproxy + +
    + dictionary +
    + + + + +
    SYN proxy options.
    +
    Only valid in 1.4 and later.
    +
    Only valid when action = synproxy.
    + + + + + + + + +
    + mss + +
    + integer +
    + + + + +
    Adjust MSS (501-65535)
    + + + + + + + + +
    + window_scale + +
    + integer +
    + + + + +
    Window scale (1-14).
    + + + @@ -1129,17 +1548,77 @@ Parameters
    flags +
    + list + / elements=dictionary +
    + + + + +
    list of tcp flags to be matched
    +
    5.0 breaking change to support 1.4+ and 1.3-
    + + + + + + + + + +
    + flag +
    string
    + -
    TCP flags to be matched.
    +
    TCP flag to be matched.
    +
    syn, ack, fin, rst, urg, psh, all (1.3-)
    +
    syn, ack, fin, rst, urg, psh, cwr, ecn (1.4+)
    + + + + + + + + + +
    + invert + +
    + boolean +
    + + + + + +
    Invert the match.
    + @@ -2408,7 +2887,7 @@ Common return values are documented `here after
    - list + dictionary
    when changed @@ -2426,7 +2905,7 @@ Common return values are documented `here before
    - list + dictionary
    always -- cgit v1.2.3