flowtable ft {
hook ingress priority 0;
- devices = { "br-lan", "wan" };
+ devices = { "eth0", "eth1" };
+ counter;
flags offload;
}
+
#
- # Set definitions
+ # CT helper definitions
#
+ ct helper amanda {
+ type "amanda" protocol udp;
+ }
+
+ ct helper ftp {
+ type "ftp" protocol tcp;
+ }
+
+ ct helper RAS {
+ type "RAS" protocol udp;
+ }
+
+ ct helper Q.931 {
+ type "Q.931" protocol tcp;
+ }
+
+ ct helper irc {
+ type "irc" protocol tcp;
+ }
+
+ ct helper netbios-ns {
+ type "netbios-ns" protocol udp;
+ }
+
+ ct helper pptp {
+ type "pptp" protocol tcp;
+ }
+
+ ct helper sane {
+ type "sane" protocol tcp;
+ }
+
+ ct helper sip {
+ type "sip" protocol udp;
+ }
+
+ ct helper snmp {
+ type "snmp" protocol udp;
+ }
+
+ ct helper tftp {
+ type "tftp" protocol udp;
+ }
+
+ ct helper rtsp {
+ type "rtsp" protocol tcp;
+ }
+
#
# Defines
#
define lan_devices = { "br-lan" }
- define lan_subnets = { 192.168.26.0/24, fd63:e2f:f706::/60 }
- define wan_devices = { "wan" }
- define wan_subnets = { 10.11.12.0/24 }
+ define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }
+
+ define wan_devices = { "pppoe-wan" }
+ define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }
+
#
# User includes
#
chain input {
- type filter hook input priority filter; policy accept;
+ type filter hook input priority filter; policy drop;
iifname "lo" accept comment "!fw4: Accept traffic from loopback"
- ct state established,related accept comment "!fw4: Allow inbound established and related flows"
+ ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
- iifname "wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
+ iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
+ jump handle_reject
}
chain forward {
type filter hook forward priority filter; policy drop;
meta l4proto { tcp, udp } flow offload @ft;
- ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
+ ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
- iifname "wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
+ iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
jump handle_reject
}
oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
- ct state established,related accept comment "!fw4: Allow outbound established and related flows"
+ ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
+ meta l4proto tcp counter comment "!fw4: Test-Deprecated-Rule-Option"
oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
- oifname "wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
+ oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
+ }
+
+ chain prerouting {
+ type filter hook prerouting priority filter; policy accept;
+ iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
}
chain handle_reject {
}
chain syn_flood {
- tcp flags & (fin | syn | rst | ack) == syn limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
+ limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
drop comment "!fw4: Drop excess packets"
}
jump accept_to_lan
}
+ chain helper_lan {
+ meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
+ meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
+ meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
+ meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
+ meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
+ meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
+ meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
+ meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
+ meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
+ meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
+ meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
+ meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
+ }
+
chain accept_from_lan {
iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
}
}
chain accept_to_wan {
- oifname "wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
+ meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage"
+ oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
}
chain reject_from_wan {
- iifname "wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
+ iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain reject_to_wan {
- oifname "wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
+ oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}
chain srcnat {
type nat hook postrouting priority srcnat; policy accept;
- oifname "wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
+ oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
}
chain srcnat_wan {
#
- # Raw rules (notrack & helper)
+ # Raw rules (notrack)
#
chain raw_prerouting {
type filter hook prerouting priority raw; policy accept;
- iifname "br-lan" jump helper_lan comment "!fw4: lan IPv4/IPv6 CT helper assignment"
}
chain raw_output {
type filter hook output priority raw; policy accept;
}
- ct helper amanda {
- type "amanda" protocol udp;
- }
-
- ct helper ftp {
- type "ftp" protocol tcp;
- }
-
- ct helper RAS {
- type "RAS" protocol udp;
- }
-
- ct helper Q.931 {
- type "Q.931" protocol tcp;
- }
-
- ct helper irc {
- type "irc" protocol tcp;
- }
-
- ct helper netbios-ns {
- type "netbios-ns" protocol udp;
- }
-
- ct helper pptp {
- type "pptp" protocol tcp;
- }
-
- ct helper sane {
- type "sane" protocol tcp;
- }
-
- ct helper sip {
- type "sip" protocol udp;
- }
-
- ct helper snmp {
- type "snmp" protocol udp;
- }
-
- ct helper tftp {
- type "tftp" protocol udp;
- }
-
- ct helper rtsp {
- type "rtsp" protocol tcp;
- }
-
- chain helper_lan {
- meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
- meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
- meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
- meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
- meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
- meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
- meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
- meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
- meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
- meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
- meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
- meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
- }
-
#
# Mangle rules
type filter hook prerouting priority mangle; policy accept;
}
+ chain mangle_postrouting {
+ type filter hook postrouting priority mangle; policy accept;
+ }
+
+ chain mangle_input {
+ type filter hook input priority mangle; policy accept;
+ }
+
chain mangle_output {
- type filter hook output priority mangle; policy accept;
+ type route hook output priority mangle; policy accept;
}
chain mangle_forward {
type filter hook forward priority mangle; policy accept;
- iifname "wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
- oifname "wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
+ iifname "pppoe-wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
+ oifname "pppoe-wan" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
}
}
-- End --
[call] fs.stat path </sys/module/nf_conntrack_snmp>
[call] fs.stat path </sys/module/nf_conntrack_tftp>
[call] fs.stat path </sys/module/nf_conntrack_rtsp>
-[call] fs.open path </sys/class/net/br-lan/flags> mode <r>
-[call] fs.open path </sys/class/net/br-lan/flags> mode <r>
+[!] Section @defaults[0] specifies unknown option 'unknown_defaults_option'
+[!] Section @rule[9] (Test-Deprecated-Rule-Option) option '_name' is deprecated by fw4
+[!] Section @rule[9] (Test-Deprecated-Rule-Option) specifies unknown option 'unknown_rule_option'
+[call] fs.glob pattern </usr/share/nftables.d/ruleset-pre/*.nft>
+[call] fs.glob pattern </usr/share/nftables.d/ruleset-post/*.nft>
+[call] fs.glob pattern </usr/share/nftables.d/table-pre/*.nft>
+[call] fs.glob pattern </usr/share/nftables.d/table-post/*.nft>
+[call] fs.lsdir path </usr/share/nftables.d/chain-pre>
+[call] fs.lsdir path </usr/share/nftables.d/chain-post>
+[call] ctx.call object <network.device> method <status> args <null>
+[call] fs.opendir path </sys/class/net/br-lan>
+[call] fs.opendir path </sys/class/net/eth0>
+[call] fs.opendir path </sys/class/net/eth1>
+[call] system command </usr/sbin/nft -c '
+ add table inet fw4-hw-offload-test;
+ add flowtable inet fw4-hw-offload-test ft {
+ hook ingress priority 0;
+ devices = { "eth0", "eth1" };
+ flags offload;
+ }
+ ' 2>/dev/null> timeout <null>
+[call] fs.popen cmdline </usr/sbin/nft --terse --json list flowtables inet> mode <r>
+[call] fs.readfile path </sys/class/net/br-lan/flags> limit <null>
+[call] fs.readfile path </sys/class/net/br-lan/flags> limit <null>
-- End --
projects / project / firewall4.git / blobdiff