tests/01_configuration/01_ruleset

   1 Testing the ruleset rendered from the default firewall configuration.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 TRACE_CALLS: "stderr",
   7
   8                 getenv: function(varname) {
   9                         switch (varname) {
  10                         case 'ACTION':
  11                                 return 'print';
  12                         }
  13                 }
  14         })
  15 %}
  16 -- End --
  17
  18 -- Expect stdout --
  19 table inet fw4
  20 flush table inet fw4
  21
  22 table inet fw4 {
  23         #
  24         # Flowtable
  25         #
  26
  27         flowtable ft {
  28                 hook ingress priority 0;
  29                 devices = { "br-lan", "wan" };
  30                 flags offload;
  31         }
  32
  33         #
  34         # Set definitions
  35         #
  36
  37
  38         #
  39         # Defines
  40         #
  41
  42         define lan_devices = { "br-lan" }
  43         define lan_subnets = { 192.168.26.0/24, fd63:e2f:f706::/60 }
  44         define wan_devices = { "wan" }
  45         define wan_subnets = { 10.11.12.0/24 }
  46
  47         #
  48         # User includes
  49         #
  50
  51         include "/etc/nftables.d/*.nft"
  52
  53
  54         #
  55         # Filter rules
  56         #
  57
  58         chain input {
  59                 type filter hook input priority filter; policy accept;
  60
  61                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
  62
  63                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
  64                 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
  65                 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
  66                 iifname "wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
  67         }
  68
  69         chain forward {
  70                 type filter hook forward priority filter; policy drop;
  71
  72                 meta l4proto { tcp, udp } flow offload @ft;
  73                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
  74                 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
  75                 iifname "wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
  76                 jump handle_reject
  77         }
  78
  79         chain output {
  80                 type filter hook output priority filter; policy accept;
  81
  82                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
  83
  84                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
  85                 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
  86                 oifname "wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
  87         }
  88
  89         chain handle_reject {
  90                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
  91                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
  92         }
  93
  94         chain syn_flood {
  95                 tcp flags & (fin | syn | rst | ack) == syn limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
  96                 drop comment "!fw4: Drop excess packets"
  97         }
  98
  99         chain input_lan {
 100                 jump accept_from_lan
 101         }
 102
 103         chain output_lan {
 104                 jump accept_to_lan
 105         }
 106
 107         chain forward_lan {
 108                 jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
 109                 jump accept_to_lan
 110         }
 111
 112         chain accept_from_lan {
 113                 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
 114         }
 115
 116         chain accept_to_lan {
 117                 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
 118         }
 119
 120         chain input_wan {
 121                 meta nfproto ipv4 udp dport 68 counter accept comment "!fw4: Allow-DHCP-Renew"
 122                 meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: Allow-Ping"
 123                 meta nfproto ipv4 meta l4proto igmp counter accept comment "!fw4: Allow-IGMP"
 124                 ip6 saddr fc00::/6 ip6 daddr fc00::/6 udp dport 546 counter accept comment "!fw4: Allow-DHCPv6"
 125                 ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { 130 . 0, 131 . 0, 132 . 0, 143 . 0 } counter accept comment "!fw4: Allow-MLD"
 126                 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3, 133, 134 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
 127                 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1, 135 . 0, 136 . 0 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
 128                 jump reject_from_wan
 129         }
 130
 131         chain output_wan {
 132                 jump accept_to_wan
 133         }
 134
 135         chain forward_wan {
 136                 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
 137                 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
 138                 meta l4proto esp counter jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
 139                 udp dport 500 counter jump accept_to_lan comment "!fw4: Allow-ISAKMP"
 140                 jump reject_to_wan
 141         }
 142
 143         chain accept_to_wan {
 144                 oifname "wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
 145         }
 146
 147         chain reject_from_wan {
 148                 iifname "wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
 149         }
 150
 151         chain reject_to_wan {
 152                 oifname "wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
 153         }
 154
 155
 156         #
 157         # NAT rules
 158         #
 159
 160         chain dstnat {
 161                 type nat hook prerouting priority dstnat; policy accept;
 162         }
 163
 164         chain srcnat {
 165                 type nat hook postrouting priority srcnat; policy accept;
 166                 oifname "wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
 167         }
 168
 169         chain srcnat_wan {
 170                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
 171         }
 172
 173
 174         #
 175         # Raw rules (notrack & helper)
 176         #
 177
 178         chain raw_prerouting {
 179                 type filter hook prerouting priority raw; policy accept;
 180                 iifname "br-lan" jump helper_lan comment "!fw4: lan IPv4/IPv6 CT helper assignment"
 181         }
 182
 183         chain raw_output {
 184                 type filter hook output priority raw; policy accept;
 185         }
 186
 187         ct helper amanda {
 188                 type "amanda" protocol udp;
 189         }
 190
 191         ct helper ftp {
 192                 type "ftp" protocol tcp;
 193         }
 194
 195         ct helper RAS {
 196                 type "RAS" protocol udp;
 197         }
 198
 199         ct helper Q.931 {
 200                 type "Q.931" protocol tcp;
 201         }
 202
 203         ct helper irc {
 204                 type "irc" protocol tcp;
 205         }
 206
 207         ct helper netbios-ns {
 208                 type "netbios-ns" protocol udp;
 209         }
 210
 211         ct helper pptp {
 212                 type "pptp" protocol tcp;
 213         }
 214
 215         ct helper sane {
 216                 type "sane" protocol tcp;
 217         }
 218
 219         ct helper sip {
 220                 type "sip" protocol udp;
 221         }
 222
 223         ct helper snmp {
 224                 type "snmp" protocol udp;
 225         }
 226
 227         ct helper tftp {
 228                 type "tftp" protocol udp;
 229         }
 230
 231         ct helper rtsp {
 232                 type "rtsp" protocol tcp;
 233         }
 234
 235         chain helper_lan {
 236                 meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
 237                 meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
 238                 meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
 239                 meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
 240                 meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
 241                 meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
 242                 meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
 243                 meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
 244                 meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
 245                 meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
 246                 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
 247                 meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
 248         }
 249
 250
 251         #
 252         # Mangle rules
 253         #
 254
 255         chain mangle_prerouting {
 256                 type filter hook prerouting priority mangle; policy accept;
 257         }
 258
 259         chain mangle_output {
 260                 type filter hook output priority mangle; policy accept;
 261         }
 262
 263         chain mangle_forward {
 264                 type filter hook forward priority mangle; policy accept;
 265                 iifname "wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
 266                 oifname "wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
 267         }
 268 }
 269 -- End --
 270
 271 -- Expect stderr --
 272 [call] ctx.call object <network.interface> method <dump> args <null>
 273 [call] ctx.call object <service> method <get_data> args <{ "type": "firewall" }>
 274 [call] fs.open path </proc/version> mode <r>
 275 [call] fs.stat path </sys/module/nf_conntrack_amanda>
 276 [call] fs.stat path </sys/module/nf_conntrack_ftp>
 277 [call] fs.stat path </sys/module/nf_conntrack_h323>
 278 [call] fs.stat path </sys/module/nf_conntrack_h323>
 279 [call] fs.stat path </sys/module/nf_conntrack_irc>
 280 [call] fs.stat path </sys/module/nf_conntrack_netbios_ns>
 281 [call] fs.stat path </sys/module/nf_conntrack_pptp>
 282 [call] fs.stat path </sys/module/nf_conntrack_sane>
 283 [call] fs.stat path </sys/module/nf_conntrack_sip>
 284 [call] fs.stat path </sys/module/nf_conntrack_snmp>
 285 [call] fs.stat path </sys/module/nf_conntrack_tftp>
 286 [call] fs.stat path </sys/module/nf_conntrack_rtsp>
 287 [call] fs.open path </sys/class/net/br-lan/flags> mode <r>
 288 [call] fs.open path </sys/class/net/br-lan/flags> mode <r>
 289 -- End --