tests/03_rules/07_redirect

   1 Test various address selection rules in redirect rules.
   2
   3 -- Testcase --
   4 {%
   5         include("./root/usr/share/firewall4/main.uc", {
   6                 getenv: function(varname) {
   7                         switch (varname) {
   8                         case 'ACTION':
   9                                 return 'print';
  10                         }
  11                 }
  12         })
  13 %}
  14 -- End --
  15
  16 -- File uci/helpers.json --
  17 {}
  18 -- End --
  19
  20 -- File uci/firewall.json --
  21 {
  22         "zone": [
  23                 {
  24                         "name": "wan",
  25                         "network": [ "wan", "wan6" ],
  26                         "masq": 1,
  27                         "masq6": 1
  28                 },
  29                 {
  30                         "name": "lan",
  31                         "network": "lan",
  32                         "auto_helper": 0
  33                 }
  34         ],
  35         "redirect": [
  36                 {
  37                         ".description": "Ensure unspecified family with no src, dest or rewrite address is treated as IPv4 only",
  38                         "name": "Redirect test #1",
  39                         "src": "lan",
  40                         "dest": "wan",
  41                         "proto": "udp",
  42                         "src_dport": "53",
  43                         "dest_port": "53",
  44                         "target": "dnat"
  45                 },
  46                 {
  47                         ".description": "Ensure that explicit family any with no src, dest or rewrite address is treated as IPv4/IPv6",
  48                         "name": "Redirect test #2",
  49                         "family": "any",
  50                         "src": "lan",
  51                         "dest": "wan",
  52                         "proto": "udp",
  53                         "src_dport": "53",
  54                         "dest_port": "53",
  55                         "target": "dnat"
  56                 },
  57                 {
  58                         ".description": "Ensure that a DNAT without explicit dest zone infers the zone from the rewrite address",
  59                         "name": "Redirect test #3",
  60                         "src": "wan",
  61                         "proto": "tcp",
  62                         "src_dport": "22",
  63                         "dest_ip": "192.168.26.100"
  64                 },
  65                 {
  66                         ".description": "Ensure that external reflection source uses the src zone addr as reflection source IP",
  67                         "name": "Redirect test #4",
  68                         "src": "wan",
  69                         "proto": "tcp",
  70                         "src_dport": "23",
  71                         "dest_ip": "192.168.26.100",
  72                         "reflection_src": "external"
  73                 }
  74         ]
  75 }
  76 -- End --
  77
  78 -- Expect stderr --
  79 [!] Section @redirect[2] (Redirect test #3) does not specify a destination, assuming 'lan'
  80 [!] Section @redirect[3] (Redirect test #4) does not specify a destination, assuming 'lan'
  81 -- End --
  82
  83 -- Expect stdout --
  84 table inet fw4
  85 flush table inet fw4
  86
  87 table inet fw4 {
  88         #
  89         # Set definitions
  90         #
  91
  92
  93         #
  94         # Defines
  95         #
  96
  97         define wan_devices = { "eth1" }
  98         define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }
  99         define lan_devices = { "br-lan" }
 100         define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }
 101
 102         #
 103         # User includes
 104         #
 105
 106         include "/etc/nftables.d/*.nft"
 107
 108
 109         #
 110         # Filter rules
 111         #
 112
 113         chain input {
 114                 type filter hook input priority filter; policy drop;
 115
 116                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 117
 118                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
 119                 iifname "eth1" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
 120                 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
 121         }
 122
 123         chain forward {
 124                 type filter hook forward priority filter; policy drop;
 125
 126                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 127                 iifname "eth1" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
 128                 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
 129         }
 130
 131         chain output {
 132                 type filter hook output priority filter; policy drop;
 133
 134                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 135
 136                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 137                 oifname "eth1" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
 138                 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
 139         }
 140
 141         chain handle_reject {
 142                 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
 143                 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
 144         }
 145
 146         chain input_wan {
 147                 ct status dnat accept comment "!fw4: Accept port redirections"
 148                 jump drop_from_wan
 149         }
 150
 151         chain output_wan {
 152                 jump drop_to_wan
 153         }
 154
 155         chain forward_wan {
 156                 ct status dnat accept comment "!fw4: Accept port forwards"
 157                 jump drop_to_wan
 158         }
 159
 160         chain drop_from_wan {
 161                 iifname "eth1" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
 162         }
 163
 164         chain drop_to_wan {
 165                 oifname "eth1" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
 166         }
 167
 168         chain input_lan {
 169                 ct status dnat accept comment "!fw4: Accept port redirections"
 170                 jump drop_from_lan
 171         }
 172
 173         chain output_lan {
 174                 jump drop_to_lan
 175         }
 176
 177         chain forward_lan {
 178                 ct status dnat accept comment "!fw4: Accept port forwards"
 179                 jump drop_to_lan
 180         }
 181
 182         chain accept_to_lan {
 183                 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
 184         }
 185
 186         chain drop_from_lan {
 187                 iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
 188         }
 189
 190         chain drop_to_lan {
 191                 oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
 192         }
 193
 194
 195         #
 196         # NAT rules
 197         #
 198
 199         chain dstnat {
 200                 type nat hook prerouting priority dstnat; policy accept;
 201                 iifname "eth1" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic"
 202                 iifname "br-lan" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic"
 203         }
 204
 205         chain srcnat {
 206                 type nat hook postrouting priority srcnat; policy accept;
 207                 oifname "eth1" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
 208                 oifname "br-lan" jump srcnat_lan comment "!fw4: Handle lan IPv4/IPv6 srcnat traffic"
 209         }
 210
 211         chain dstnat_wan {
 212                 meta nfproto ipv4 tcp dport 22 counter dnat 192.168.26.100:22 comment "!fw4: Redirect test #3"
 213                 meta nfproto ipv4 tcp dport 23 counter dnat 192.168.26.100:23 comment "!fw4: Redirect test #4"
 214         }
 215
 216         chain srcnat_wan {
 217                 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
 218                 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 wan traffic"
 219         }
 220
 221         chain dstnat_lan {
 222                 meta nfproto ipv4 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #1"
 223                 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #2"
 224                 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 22 dnat 192.168.26.100:22 comment "!fw4: Redirect test #3 (reflection)"
 225                 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 23 dnat 192.168.26.100:23 comment "!fw4: Redirect test #4 (reflection)"
 226         }
 227
 228         chain srcnat_lan {
 229                 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 22 snat 192.168.26.1 comment "!fw4: Redirect test #3 (reflection)"
 230                 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 23 snat 10.11.12.194 comment "!fw4: Redirect test #4 (reflection)"
 231         }
 232
 233
 234         #
 235         # Raw rules (notrack & helper)
 236         #
 237
 238         chain raw_prerouting {
 239                 type filter hook prerouting priority raw; policy accept;
 240         }
 241
 242         chain raw_output {
 243                 type filter hook output priority raw; policy accept;
 244         }
 245
 246
 247         #
 248         # Mangle rules
 249         #
 250
 251         chain mangle_prerouting {
 252                 type filter hook prerouting priority mangle; policy accept;
 253         }
 254
 255         chain mangle_postrouting {
 256                 type filter hook postrouting priority mangle; policy accept;
 257         }
 258
 259         chain mangle_input {
 260                 type filter hook input priority mangle; policy accept;
 261         }
 262
 263         chain mangle_output {
 264                 type filter hook output priority mangle; policy accept;
 265         }
 266
 267         chain mangle_forward {
 268                 type filter hook forward priority mangle; policy accept;
 269         }
 270 }
 271 -- End --