root/usr/share/firewall4/templates/ruleset.uc

   1 {%
   2         let flowtable_devices = fw4.resolve_offload_devices();
   3         let available_helpers = filter(fw4.helpers(), h => h.available);
   4         let defined_ipsets = fw4.ipsets();
   5 -%}
   6
   7 table inet fw4
   8 flush table inet fw4
   9 {% if (fw4.check_flowtable()): %}
  10 delete flowtable inet fw4 ft
  11 {% endif %}
  12 {% fw4.includes('ruleset-prepend') %}
  13
  14 table inet fw4 {
  15 {% if (length(flowtable_devices) > 0): %}
  16         #
  17         # Flowtable
  18         #
  19
  20         flowtable ft {
  21                 hook ingress priority 0;
  22                 devices = {{ fw4.set(flowtable_devices, true) }};
  23 {% if (fw4.default_option("flow_offloading_hw")): %}
  24                 flags offload;
  25 {% endif %}
  26         }
  27
  28
  29 {% endif %}
  30 {% if (length(available_helpers)): %}
  31         #
  32         # CT helper definitions
  33         #
  34
  35 {%  for (let helper in available_helpers): %}
  36 {%   for (let proto in helper.proto): %}
  37         ct helper {{ helper.name }} {
  38                 type {{ fw4.quote(helper.name, true) }} protocol {{ proto.name }};
  39         }
  40
  41 {%   endfor %}
  42 {%  endfor %}
  43
  44 {% endif %}
  45 {% if (length(defined_ipsets)): %}
  46         #
  47         # Set definitions
  48         #
  49
  50 {%  for (let set in defined_ipsets): %}
  51         set {{ set.name }} {
  52                 type {{ fw4.concat(set.types) }}
  53 {%   if (set.maxelem > 0): %}
  54                 size {{ set.maxelem }}
  55 {%   endif %}
  56 {%   if (set.timeout >= 0): %}
  57                 timeout {{ set.timeout }}s
  58 {%   endif %}
  59 {%   if (set.interval): %}
  60                 flags interval
  61                 auto-merge
  62 {%   endif %}
  63 {%   fw4.print_setentries(set) %}
  64         }
  65
  66 {%  endfor %}
  67
  68 {% endif %}
  69         #
  70         # Defines
  71         #
  72
  73 {% for (let zone in fw4.zones()): %}
  74         define {{ zone.name }}_devices = {{ fw4.set(zone.match_devices, true) }}
  75         define {{ zone.name }}_subnets = {{ fw4.set(zone.match_subnets, true) }}
  76
  77 {% endfor %}
  78
  79         #
  80         # User includes
  81         #
  82
  83         include "/etc/nftables.d/*.nft"
  84 {% fw4.includes('table-prepend') %}
  85
  86
  87         #
  88         # Filter rules
  89         #
  90
  91         chain input {
  92                 type filter hook input priority filter; policy {{ fw4.input_policy(true) }};
  93
  94                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
  95
  96 {% fw4.includes('chain-prepend', 'input') %}
  97                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
  98 {% if (fw4.default_option("drop_invalid")): %}
  99                 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
 100 {% endif %}
 101 {% if (fw4.default_option("synflood_protect") && fw4.default_option("synflood_rate")): %}
 102                 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
 103 {% endif %}
 104 {% for (let rule in fw4.rules("input")): %}
 105                 {%+ include("rule.uc", { fw4, rule }) %}
 106 {% endfor %}
 107 {% for (let zone in fw4.zones()): for (let rule in zone.match_rules): %}
 108                 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "input" }) %}
 109 {% endfor; endfor %}
 110 {% if (fw4.input_policy() == "reject"): %}
 111                 jump handle_reject
 112 {% endif %}
 113 {% fw4.includes('chain-append', 'input') %}
 114         }
 115
 116         chain forward {
 117                 type filter hook forward priority filter; policy {{ fw4.forward_policy(true) }};
 118
 119 {% if (length(flowtable_devices) > 0): %}
 120                 meta l4proto { tcp, udp } flow offload @ft;
 121 {% endif %}
 122 {% fw4.includes('chain-prepend', 'forward') %}
 123                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
 124 {% if (fw4.default_option("drop_invalid")): %}
 125                 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
 126 {% endif %}
 127 {% for (let rule in fw4.rules("forward")): %}
 128                 {%+ include("rule.uc", { fw4, rule }) %}
 129 {% endfor %}
 130 {% for (let zone in fw4.zones()): for (let rule in zone.match_rules): %}
 131                 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "forward" }) %}
 132 {% endfor; endfor %}
 133 {% fw4.includes('chain-append', 'forward') %}
 134 {% if (fw4.forward_policy() == "reject"): %}
 135                 jump handle_reject
 136 {% endif %}
 137         }
 138
 139         chain output {
 140                 type filter hook output priority filter; policy {{ fw4.output_policy(true) }};
 141
 142                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 143
 144 {% fw4.includes('chain-prepend', 'output') %}
 145                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 146 {% if (fw4.default_option("drop_invalid")): %}
 147                 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
 148 {% endif %}
 149 {% for (let rule in fw4.rules("output")): %}
 150                 {%+ include("rule.uc", { fw4, rule }) %}
 151 {% endfor %}
 152 {% for (let zone in fw4.zones()): %}
 153 {%  for (let rule in zone.match_rules): %}
 154 {%   if (zone.dflags.helper): %}
 155 {%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, true); %}
 156 {%    let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, true); %}
 157 {%    if (devices_pos || subnets_pos): %}
 158                 {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "helper" }) %}
 159 {%    endif %}
 160 {%   endif %}
 161                 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "output" }) %}
 162 {%  endfor %}
 163 {% endfor %}
 164 {% fw4.includes('chain-append', 'output') %}
 165 {% if (fw4.output_policy() == "reject"): %}
 166                 jump handle_reject
 167 {% endif %}
 168         }
 169
 170         chain prerouting {
 171                 type filter hook prerouting priority filter; policy accept;
 172 {% for (let zone in fw4.zones()): %}
 173 {%  if (zone.dflags.helper): %}
 174 {%   for (let rule in zone.match_rules): %}
 175 {%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, false); %}
 176 {%    let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, false); %}
 177 {%    if (rule.devices_neg || rule.subnets_neg || devices_pos || subnets_pos): %}
 178                 {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "helper" }) %}
 179 {%    endif %}
 180 {%   endfor %}
 181 {%  endif %}
 182 {% endfor %}
 183         }
 184
 185         chain handle_reject {
 186                 meta l4proto tcp reject with {{
 187                         (fw4.default_option("tcp_reject_code") != "tcp-reset")
 188                                 ? `icmpx type ${fw4.default_option("tcp_reject_code")}`
 189                                 : "tcp reset"
 190                 }} comment "!fw4: Reject TCP traffic"
 191                 reject with {{
 192                         (fw4.default_option("any_reject_code") != "tcp-reset")
 193                                 ? `icmpx type ${fw4.default_option("any_reject_code")}`
 194                                 : "tcp reset"
 195                 }} comment "!fw4: Reject any other traffic"
 196         }
 197
 198 {% if (fw4.default_option("synflood_protect") && fw4.default_option("synflood_rate")):
 199         let r = fw4.default_option("synflood_rate");
 200         let b = fw4.default_option("synflood_burst");
 201 %}
 202         chain syn_flood {
 203                 limit rate {{ r.rate }}/{{ r.unit }}
 204                 {%- if (b): %} burst {{ b }} packets{% endif %} return comment "!fw4: Accept SYN packets below rate-limit"
 205                 drop comment "!fw4: Drop excess packets"
 206         }
 207
 208 {% endif %}
 209 {% for (let zone in fw4.zones()): %}
 210         chain input_{{ zone.name }} {
 211 {%  fw4.includes('chain-prepend', `input_${zone.name}`) %}
 212 {%  for (let rule in fw4.rules(`input_${zone.name}`)): %}
 213                 {%+ include("rule.uc", { fw4, rule }) %}
 214 {%  endfor %}
 215 {%  if (zone.dflags.dnat): %}
 216                 ct status dnat accept comment "!fw4: Accept port redirections"
 217 {%  endif %}
 218 {%  fw4.includes('chain-append', `input_${zone.name}`) %}
 219                 jump {{ zone.input }}_from_{{ zone.name }}
 220         }
 221
 222         chain output_{{ zone.name }} {
 223 {%  fw4.includes('chain-prepend', `output_${zone.name}`) %}
 224 {%  for (let rule in fw4.rules(`output_${zone.name}`)): %}
 225                 {%+ include("rule.uc", { fw4, rule }) %}
 226 {%  endfor %}
 227 {%  fw4.includes('chain-append', `output_${zone.name}`) %}
 228                 jump {{ zone.output }}_to_{{ zone.name }}
 229         }
 230
 231         chain forward_{{ zone.name }} {
 232 {%  fw4.includes('chain-prepend', `forward_${zone.name}`) %}
 233 {%  for (let rule in fw4.rules(`forward_${zone.name}`)): %}
 234                 {%+ include("rule.uc", { fw4, rule }) %}
 235 {%  endfor %}
 236 {%  if (zone.dflags.dnat): %}
 237                 ct status dnat accept comment "!fw4: Accept port forwards"
 238 {%  endif %}
 239 {%  fw4.includes('chain-append', `forward_${zone.name}`) %}
 240                 jump {{ zone.forward }}_to_{{ zone.name }}
 241         }
 242
 243 {%  if (zone.dflags.helper): %}
 244         chain helper_{{ zone.name }} {
 245 {%   for (let rule in fw4.rules(`helper_${zone.name}`)): %}
 246                 {%+ include("rule.uc", { fw4, rule }) %}
 247 {%   endfor %}
 248         }
 249
 250 {%  endif %}
 251 {%  for (let verdict in ["accept", "reject", "drop"]): %}
 252 {%   if (zone.sflags[verdict]): %}
 253         chain {{ verdict }}_from_{{ zone.name }} {
 254 {%    for (let rule in zone.match_rules): %}
 255                 {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: false, verdict }) %}
 256 {%    endfor %}
 257         }
 258
 259 {%   endif %}
 260 {%   if (zone.dflags[verdict]): %}
 261         chain {{ verdict }}_to_{{ zone.name }} {
 262 {%   for (let rule in zone.match_rules): %}
 263                 {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: true, verdict }) %}
 264 {%   endfor %}
 265         }
 266
 267 {%   endif %}
 268 {%  endfor %}
 269 {% endfor %}
 270
 271         #
 272         # NAT rules
 273         #
 274
 275         chain dstnat {
 276                 type nat hook prerouting priority dstnat; policy accept;
 277 {% fw4.includes('chain-prepend', 'dstnat') %}
 278 {% for (let zone in fw4.zones()): %}
 279 {%  if (zone.dflags.dnat): %}
 280 {%   for (let rule in zone.match_rules): %}
 281                 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "dstnat" }) %}
 282 {%   endfor %}
 283 {%  endif %}
 284 {% endfor %}
 285 {% fw4.includes('chain-append', 'dstnat') %}
 286         }
 287
 288         chain srcnat {
 289                 type nat hook postrouting priority srcnat; policy accept;
 290 {% fw4.includes('chain-prepend', 'srcnat') %}
 291 {% for (let redirect in fw4.redirects("srcnat")): %}
 292                 {%+ include("redirect.uc", { fw4, redirect }) %}
 293 {% endfor %}
 294 {% for (let zone in fw4.zones()): %}
 295 {%  if (zone.dflags.snat): %}
 296 {%   for (let rule in zone.match_rules): %}
 297                 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "srcnat" }) %}
 298 {%   endfor %}
 299 {%  endif %}
 300 {% endfor %}
 301 {% fw4.includes('chain-append', 'srcnat') %}
 302         }
 303
 304 {% for (let zone in fw4.zones()): %}
 305 {%  if (zone.dflags.dnat): %}
 306         chain dstnat_{{ zone.name }} {
 307 {%   fw4.includes('chain-prepend', `dstnat_${zone.name}`) %}
 308 {%   for (let redirect in fw4.redirects(`dstnat_${zone.name}`)): %}
 309                 {%+ include("redirect.uc", { fw4, redirect }) %}
 310 {%   endfor %}
 311 {%   fw4.includes('chain-append', `dstnat_${zone.name}`) %}
 312         }
 313
 314 {%  endif %}
 315 {%  if (zone.dflags.snat): %}
 316         chain srcnat_{{ zone.name }} {
 317 {%   fw4.includes('chain-prepend', `srcnat_${zone.name}`) %}
 318 {%   for (let redirect in fw4.redirects(`srcnat_${zone.name}`)): %}
 319                 {%+ include("redirect.uc", { fw4, redirect }) %}
 320 {%   endfor %}
 321 {%   if (zone.masq): %}
 322 {%    for (let saddrs in zone.masq4_src_subnets): %}
 323 {%     for (let daddrs in zone.masq4_dest_subnets): %}
 324                 {%+ include("zone-masq.uc", { fw4, zone, family: 4, saddrs, daddrs }) %}
 325 {%     endfor %}
 326 {%    endfor %}
 327 {%   endif %}
 328 {%   if (zone.masq6): %}
 329 {%    for (let saddrs in zone.masq6_src_subnets): %}
 330 {%     for (let daddrs in zone.masq6_dest_subnets): %}
 331                 {%+ include("zone-masq.uc", { fw4, zone, family: 6, saddrs, daddrs }) %}
 332 {%     endfor %}
 333 {%    endfor %}
 334 {%   endif %}
 335 {%   fw4.includes('chain-append', `srcnat_${zone.name}`) %}
 336         }
 337
 338 {%  endif %}
 339 {% endfor %}
 340
 341         #
 342         # Raw rules (notrack)
 343         #
 344
 345         chain raw_prerouting {
 346                 type filter hook prerouting priority raw; policy accept;
 347 {% for (let zone in fw4.zones()): %}
 348 {%  if (zone.dflags["notrack"]): %}
 349 {%   for (let rule in zone.match_rules): %}
 350 {%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, false); %}
 351 {%    let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, false); %}
 352 {%    if (rule.devices_neg || rule.subnets_neg || devices_pos || subnets_pos): %}
 353                 {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "notrack" }) %}
 354 {%    endif %}
 355 {%   endfor %}
 356 {%  endif %}
 357 {% endfor %}
 358 {% fw4.includes('chain-append', 'raw_prerouting') %}
 359         }
 360
 361         chain raw_output {
 362                 type filter hook output priority raw; policy accept;
 363 {% fw4.includes('chain-prepend', 'raw_output') %}
 364 {% for (let zone in fw4.zones()): %}
 365 {%  if (zone.dflags["notrack"]): %}
 366 {%   for (let rule in zone.match_rules): %}
 367 {%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, true); %}
 368 {%    let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, true); %}
 369 {%    if (devices_pos || subnets_pos): %}
 370                 {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "notrack" }) %}
 371 {%    endif %}
 372 {%   endfor %}
 373 {%  endif %}
 374 {% endfor %}
 375 {% fw4.includes('chain-append', 'raw_output') %}
 376         }
 377
 378 {% for (let zone in fw4.zones()): %}
 379 {%   if (zone.dflags.notrack): %}
 380         chain notrack_{{ zone.name }} {
 381 {% for (let rule in fw4.rules(`notrack_${zone.name}`)): %}
 382                 {%+ include("rule.uc", { fw4, rule }) %}
 383 {% endfor %}
 384         }
 385
 386 {%   endif %}
 387 {% endfor %}
 388
 389         #
 390         # Mangle rules
 391         #
 392
 393         chain mangle_prerouting {
 394                 type filter hook prerouting priority mangle; policy accept;
 395 {% fw4.includes('chain-prepend', 'mangle_prerouting') %}
 396 {% for (let rule in fw4.rules("mangle_prerouting")): %}
 397                 {%+ include("rule.uc", { fw4, rule }) %}
 398 {% endfor %}
 399 {% fw4.includes('chain-append', 'mangle_prerouting') %}
 400         }
 401
 402         chain mangle_postrouting {
 403                 type filter hook postrouting priority mangle; policy accept;
 404 {% fw4.includes('chain-prepend', 'mangle_postrouting') %}
 405 {% for (let rule in fw4.rules("mangle_postrouting")): %}
 406                 {%+ include("rule.uc", { fw4, rule }) %}
 407 {% endfor %}
 408 {% fw4.includes('chain-append', 'mangle_postrouting') %}
 409         }
 410
 411         chain mangle_input {
 412                 type filter hook input priority mangle; policy accept;
 413 {% fw4.includes('chain-prepend', 'mangle_input') %}
 414 {% for (let rule in fw4.rules("mangle_input")): %}
 415                 {%+ include("rule.uc", { fw4, rule }) %}
 416 {% endfor %}
 417 {% fw4.includes('chain-append', 'mangle_input') %}
 418         }
 419
 420         chain mangle_output {
 421                 type route hook output priority mangle; policy accept;
 422 {% fw4.includes('chain-prepend', 'mangle_output') %}
 423 {% for (let rule in fw4.rules("mangle_output")): %}
 424                 {%+ include("rule.uc", { fw4, rule }) %}
 425 {% endfor %}
 426 {% fw4.includes('chain-append', 'mangle_output') %}
 427         }
 428
 429         chain mangle_forward {
 430                 type filter hook forward priority mangle; policy accept;
 431 {% fw4.includes('chain-prepend', 'mangle_forward') %}
 432 {% for (let rule in fw4.rules("mangle_forward")): %}
 433                 {%+ include("rule.uc", { fw4, rule }) %}
 434 {% endfor %}
 435 {% for (let zone in fw4.zones()): %}
 436 {%  if (zone.mtu_fix): %}
 437 {%   for (let rule in zone.match_rules): %}
 438                 {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: false }) %}
 439                 {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: true }) %}
 440 {%   endfor %}
 441 {%  endif %}
 442 {% endfor %}
 443 {% fw4.includes('chain-append', 'mangle_forward') %}
 444         }
 445 {% fw4.includes('table-append') %}
 446 }
 447 {% fw4.includes('ruleset-append') %}