tests/03_rules/07_redirect

   1 Test various address selection rules in redirect rules.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File uci/helpers.json --
  17 {}
  18 -- End --
  19
  20 -- File uci/firewall.json --
  21 {
  22         "zone": [
  23                 {
  24                         "name": "wan",
  25                         "network": [ "wan", "wan6" ],
  26                         "masq": 1,
  27                         "masq6": 1
  28                 },
  29                 {
  30                         "name": "lan",
  31                         "network": "lan",
  32                         "auto_helper": 0
  33                 },
  34                 {
  35                         "name": "noaddr",
  36                         "network": [ "noaddr" ],
  37                         "masq": 1,
  38                         "masq6": 1
  39                 }
  40         ],
  41         "redirect": [
  42                 {
  43                         ".description": "Ensure unspecified family with no src, dest or rewrite address is treated as IPv4 only",
  44                         "name": "Redirect test #1",
  45                         "src": "lan",
  46                         "dest": "wan",
  47                         "proto": "udp",
  48                         "src_dport": "53",
  49                         "dest_port": "53",
  50                         "target": "dnat"
  51                 },
  52                 {
  53                         ".description": "Ensure that explicit family any with no src, dest or rewrite address is treated as IPv4/IPv6",
  54                         "name": "Redirect test #2",
  55                         "family": "any",
  56                         "src": "lan",
  57                         "dest": "wan",
  58                         "proto": "udp",
  59                         "src_dport": "53",
  60                         "dest_port": "53",
  61                         "target": "dnat"
  62                 },
  63                 {
  64                         ".description": "Ensure that a DNAT without explicit dest zone infers the zone from the rewrite address",
  65                         "name": "Redirect test #3",
  66                         "src": "wan",
  67                         "proto": "tcp",
  68                         "src_dport": "22",
  69                         "dest_ip": "192.168.26.100"
  70                 },
  71                 {
  72                         ".description": "Ensure that external reflection source uses the src zone addr as reflection source IP",
  73                         "name": "Redirect test #4",
  74                         "src": "wan",
  75                         "proto": "tcp",
  76                         "src_dport": "23",
  77                         "dest_ip": "192.168.26.100",
  78                         "reflection_src": "external"
  79                 },
  80                 {
  81                         ".description": "Ensure that reflection is disabled if external address cannot be determined",
  82                         "name": "Redirect test #5",
  83                         "src": "noaddr",
  84                         "dest": "lan",
  85                         "proto": "tcp",
  86                         "src_dport": "24",
  87                         "dest_ip": "192.168.26.100"
  88                 }
  89         ]
  90 }
  91 -- End --
  92
  93 -- Expect stderr --
  94 [!] Section @redirect[2] (Redirect test #3) does not specify a destination, assuming 'lan'
  95 [!] Section @redirect[3] (Redirect test #4) does not specify a destination, assuming 'lan'
  96 [!] Section @redirect[4] (Redirect test #5) external address range cannot be determined, disabling reflection
  97 -- End --
  98
  99 -- Expect stdout --
 100 table inet fw4
 101 flush table inet fw4
 102
 103 table inet fw4 {
 104         #
 105         # Set definitions
 106         #
 107
 108
 109         #
 110         # Defines
 111         #
 112
 113         define wan_devices = { "pppoe-wan" }
 114         define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }
 115         define lan_devices = { "br-lan" }
 116         define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }
 117         define noaddr_devices = { "wwan0" }
 118
 119         #
 120         # User includes
 121         #
 122
 123         include "/etc/nftables.d/*.nft"
 124
 125
 126         #
 127         # Filter rules
 128         #
 129
 130         chain input {
 131                 type filter hook input priority filter; policy drop;
 132
 133                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 134
 135                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 136                 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
 137                 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
 138                 iifname "wwan0" jump input_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 input traffic"
 139         }
 140
 141         chain forward {
 142                 type filter hook forward priority filter; policy drop;
 143
 144                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 145                 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
 146                 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
 147                 iifname "wwan0" jump forward_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 forward traffic"
 148         }
 149
 150         chain output {
 151                 type filter hook output priority filter; policy drop;
 152
 153                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 154
 155                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 156                 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
 157                 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
 158                 oifname "wwan0" jump output_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 output traffic"
 159         }
 160
 161         chain handle_reject {
 162                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 163                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 164         }
 165
 166         chain input_wan {
 167                 ct status dnat accept comment "!fw4: Accept port redirections"
 168                 jump drop_from_wan
 169         }
 170
 171         chain output_wan {
 172                 jump drop_to_wan
 173         }
 174
 175         chain forward_wan {
 176                 ct status dnat accept comment "!fw4: Accept port forwards"
 177                 jump drop_to_wan
 178         }
 179
 180         chain drop_from_wan {
 181                 iifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
 182         }
 183
 184         chain drop_to_wan {
 185                 oifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
 186         }
 187
 188         chain input_lan {
 189                 ct status dnat accept comment "!fw4: Accept port redirections"
 190                 jump drop_from_lan
 191         }
 192
 193         chain output_lan {
 194                 jump drop_to_lan
 195         }
 196
 197         chain forward_lan {
 198                 ct status dnat accept comment "!fw4: Accept port forwards"
 199                 jump drop_to_lan
 200         }
 201
 202         chain accept_to_lan {
 203                 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
 204         }
 205
 206         chain drop_from_lan {
 207                 iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
 208         }
 209
 210         chain drop_to_lan {
 211                 oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
 212         }
 213
 214         chain input_noaddr {
 215                 ct status dnat accept comment "!fw4: Accept port redirections"
 216                 jump drop_from_noaddr
 217         }
 218
 219         chain output_noaddr {
 220                 jump drop_to_noaddr
 221         }
 222
 223         chain forward_noaddr {
 224                 ct status dnat accept comment "!fw4: Accept port forwards"
 225                 jump drop_to_noaddr
 226         }
 227
 228         chain drop_from_noaddr {
 229                 iifname "wwan0" counter drop comment "!fw4: drop noaddr IPv4/IPv6 traffic"
 230         }
 231
 232         chain drop_to_noaddr {
 233                 oifname "wwan0" counter drop comment "!fw4: drop noaddr IPv4/IPv6 traffic"
 234         }
 235
 236
 237         #
 238         # NAT rules
 239         #
 240
 241         chain dstnat {
 242                 type nat hook prerouting priority dstnat; policy accept;
 243                 iifname "pppoe-wan" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic"
 244                 iifname "br-lan" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic"
 245                 iifname "wwan0" jump dstnat_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 dstnat traffic"
 246         }
 247
 248         chain srcnat {
 249                 type nat hook postrouting priority srcnat; policy accept;
 250                 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
 251                 oifname "br-lan" jump srcnat_lan comment "!fw4: Handle lan IPv4/IPv6 srcnat traffic"
 252                 oifname "wwan0" jump srcnat_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 srcnat traffic"
 253         }
 254
 255         chain dstnat_wan {
 256                 meta nfproto ipv4 tcp dport 22 counter dnat 192.168.26.100:22 comment "!fw4: Redirect test #3"
 257                 meta nfproto ipv4 tcp dport 23 counter dnat 192.168.26.100:23 comment "!fw4: Redirect test #4"
 258         }
 259
 260         chain srcnat_wan {
 261                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
 262                 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 wan traffic"
 263         }
 264
 265         chain dstnat_lan {
 266                 meta nfproto ipv4 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #1"
 267                 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #2"
 268                 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 22 dnat 192.168.26.100:22 comment "!fw4: Redirect test #3 (reflection)"
 269                 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 23 dnat 192.168.26.100:23 comment "!fw4: Redirect test #4 (reflection)"
 270         }
 271
 272         chain srcnat_lan {
 273                 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 22 snat 192.168.26.1 comment "!fw4: Redirect test #3 (reflection)"
 274                 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 23 snat 10.11.12.194 comment "!fw4: Redirect test #4 (reflection)"
 275         }
 276
 277         chain dstnat_noaddr {
 278                 meta nfproto ipv4 tcp dport 24 counter dnat 192.168.26.100:24 comment "!fw4: Redirect test #5"
 279         }
 280
 281         chain srcnat_noaddr {
 282                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 noaddr traffic"
 283                 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 noaddr traffic"
 284         }
 285
 286
 287         #
 288         # Raw rules (notrack & helper)
 289         #
 290
 291         chain raw_prerouting {
 292                 type filter hook prerouting priority raw; policy accept;
 293         }
 294
 295         chain raw_output {
 296                 type filter hook output priority raw; policy accept;
 297         }
 298
 299
 300         #
 301         # Mangle rules
 302         #
 303
 304         chain mangle_prerouting {
 305                 type filter hook prerouting priority mangle; policy accept;
 306         }
 307
 308         chain mangle_postrouting {
 309                 type filter hook postrouting priority mangle; policy accept;
 310         }
 311
 312         chain mangle_input {
 313                 type filter hook input priority mangle; policy accept;
 314         }
 315
 316         chain mangle_output {
 317                 type filter hook output priority mangle; policy accept;
 318         }
 319
 320         chain mangle_forward {
 321                 type filter hook forward priority mangle; policy accept;
 322         }
 323 }
 324 -- End --