1 {% let flowtable_devices = fw4.resolve_offload_devices(); -%}
5 {% if (fw4.check_flowtable()): %}
6 delete flowtable inet fw4 ft
10 {% if (length(flowtable_devices) > 0): %}
16 hook ingress priority 0;
17 devices = {{ fw4.set(flowtable_devices, true) }};
18 {% if (fw4.default_option("flow_offloading_hw")): %}
28 {% for (let set in fw4.ipsets()): %}
30 type {{ fw4.concat(set.types) }}
31 {% if (set.maxelem > 0): %}
32 size {{ set.maxelem }}
34 {% if (set.timeout >= 0): %}
35 timeout {{ set.timeout }}s
37 {% if (set.interval): %}
41 {% fw4.print_setentries(set) %}
50 {% for (let zone in fw4.zones()): %}
51 {% if (length(zone.match_devices)): %}
52 define {{ zone.name }}_devices = {{ fw4.set(zone.match_devices, true) }}
54 {% if (length(zone.match_subnets)): %}
55 define {{ zone.name }}_subnets = {{ fw4.set(zone.match_subnets, true) }}
63 include "/etc/nftables.d/*.nft"
71 type filter hook input priority filter; policy {{ fw4.input_policy(true) }};
73 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
75 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
76 {% if (fw4.default_option("drop_invalid")): %}
77 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
79 {% if (fw4.default_option("synflood_protect") && fw4.default_option("synflood_rate")): %}
80 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
82 {% for (let rule in fw4.rules("input")): %}
83 {%+ include("rule.uc", { fw4, rule }) %}
85 {% for (let zone in fw4.zones()): for (let rule in zone.match_rules): %}
86 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "input" }) %}
88 {% if (fw4.input_policy() == "reject"): %}
94 type filter hook forward priority filter; policy {{ fw4.forward_policy(true) }};
96 {% if (length(flowtable_devices) > 0): %}
97 meta l4proto { tcp, udp } flow offload @ft;
99 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
100 {% if (fw4.default_option("drop_invalid")): %}
101 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
103 {% for (let rule in fw4.rules("forward")): %}
104 {%+ include("rule.uc", { fw4, rule }) %}
106 {% for (let zone in fw4.zones()): for (let rule in zone.match_rules): %}
107 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "forward" }) %}
109 {% if (fw4.forward_policy() == "reject"): %}
115 type filter hook output priority filter; policy {{ fw4.output_policy(true) }};
117 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
119 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
120 {% if (fw4.default_option("drop_invalid")): %}
121 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
123 {% for (let rule in fw4.rules("output")): %}
124 {%+ include("rule.uc", { fw4, rule }) %}
126 {% for (let zone in fw4.zones()): for (let rule in zone.match_rules): %}
127 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "output" }) %}
129 {% if (fw4.output_policy() == "reject"): %}
134 chain handle_reject {
135 meta l4proto tcp reject with {{
136 (fw4.default_option("tcp_reject_code") != "tcp-reset")
137 ? "icmpx type " + fw4.default_option("tcp_reject_code")
139 }} comment "!fw4: Reject TCP traffic"
141 (fw4.default_option("any_reject_code") != "tcp-reset")
142 ? "icmpx type " + fw4.default_option("any_reject_code")
144 }} comment "!fw4: Reject any other traffic"
147 {% if (fw4.default_option("synflood_protect") && fw4.default_option("synflood_rate")):
148 let r = fw4.default_option("synflood_rate");
149 let b = fw4.default_option("synflood_burst");
152 limit rate {{ r.rate }}/{{ r.unit }}
153 {%- if (b): %} burst {{ b }} packets{% endif %} return comment "!fw4: Accept SYN packets below rate-limit"
154 drop comment "!fw4: Drop excess packets"
158 {% for (let zone in fw4.zones()): %}
159 chain input_{{ zone.name }} {
160 {% for (let rule in fw4.rules("input_"+zone.name)): %}
161 {%+ include("rule.uc", { fw4, rule }) %}
163 {% if (zone.dflags.dnat): %}
164 ct status dnat accept comment "!fw4: Accept port redirections"
166 jump {{ zone.input }}_from_{{ zone.name }}
169 chain output_{{ zone.name }} {
170 {% for (let rule in fw4.rules("output_"+zone.name)): %}
171 {%+ include("rule.uc", { fw4, rule }) %}
173 jump {{ zone.output }}_to_{{ zone.name }}
176 chain forward_{{ zone.name }} {
177 {% for (let rule in fw4.rules("forward_"+zone.name)): %}
178 {%+ include("rule.uc", { fw4, rule }) %}
180 {% if (zone.dflags.dnat): %}
181 ct status dnat accept comment "!fw4: Accept port forwards"
183 jump {{ zone.forward }}_to_{{ zone.name }}
186 {% for (let verdict in ["accept", "reject", "drop"]): %}
187 {% if (zone.sflags[verdict]): %}
188 chain {{ verdict }}_from_{{ zone.name }} {
189 {% for (let rule in zone.match_rules): %}
190 {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: false, verdict }) %}
195 {% if (zone.dflags[verdict]): %}
196 chain {{ verdict }}_to_{{ zone.name }} {
197 {% for (let rule in zone.match_rules): %}
198 {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: true, verdict }) %}
211 type nat hook prerouting priority dstnat; policy accept;
212 {% for (let zone in fw4.zones()): %}
213 {% if (zone.dflags.dnat): %}
214 {% for (let rule in zone.match_rules): %}
215 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "dstnat" }) %}
222 type nat hook postrouting priority srcnat; policy accept;
223 {% for (let redirect in fw4.redirects("srcnat")): %}
224 {%+ include("redirect.uc", { fw4, redirect }) %}
226 {% for (let zone in fw4.zones()): %}
227 {% if (zone.dflags.snat): %}
228 {% for (let rule in zone.match_rules): %}
229 {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "srcnat" }) %}
235 {% for (let zone in fw4.zones()): %}
236 {% if (zone.dflags.dnat): %}
237 chain dstnat_{{ zone.name }} {
238 {% for (let redirect in fw4.redirects("dstnat_"+zone.name)): %}
239 {%+ include("redirect.uc", { fw4, redirect }) %}
244 {% if (zone.dflags.snat): %}
245 chain srcnat_{{ zone.name }} {
246 {% for (let redirect in fw4.redirects("srcnat_"+zone.name)): %}
247 {%+ include("redirect.uc", { fw4, redirect }) %}
249 {% if (zone.masq): %}
250 {% for (let saddrs in zone.masq4_src_subnets): %}
251 {% for (let daddrs in zone.masq4_dest_subnets): %}
252 {%+ include("zone-masq.uc", { fw4, zone, family: 4, saddrs, daddrs }) %}
256 {% if (zone.masq6): %}
257 {% for (let saddrs in zone.masq6_src_subnets): %}
258 {% for (let daddrs in zone.masq6_dest_subnets): %}
259 {%+ include("zone-masq.uc", { fw4, zone, family: 6, saddrs, daddrs }) %}
269 # Raw rules (notrack & helper)
272 chain raw_prerouting {
273 type filter hook prerouting priority raw; policy accept;
274 {% for (let target in ["helper", "notrack"]): %}
275 {% for (let zone in fw4.zones()): %}
276 {% if (zone.dflags[target]): %}
277 {% for (let rule in zone.match_rules): %}
278 {% let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, false); %}
279 {% let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, false); %}
280 {% if (rule.devices_neg || rule.subnets_neg || devices_pos || subnets_pos): %}
281 {%+ if (rule.family): -%}
282 meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
283 {%+ include("zone-match.uc", { fw4, egress: false, rule: { ...rule, devices_pos, subnets_pos } }) -%}
284 jump {{ target }}_{{ zone.name }} comment "!fw4: {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} {{
285 (target == "helper") ? "CT helper assignment" : "CT bypass"
295 type filter hook output priority raw; policy accept;
296 {% for (let target in ["helper", "notrack"]): %}
297 {% for (let zone in fw4.zones()): %}
298 {% if (zone.dflags[target]): %}
299 {% for (let rule in zone.match_rules): %}
300 {% let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, true); %}
301 {% let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, true); %}
302 {% if (devices_pos || subnets_pos): %}
303 {%+ if (rule.family): -%}
304 meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
305 {%+ include("zone-match.uc", { fw4, egress: false, rule: { ...rule, devices_pos, subnets_pos } }) -%}
306 jump {{ target }}_{{ zone.name }} comment "!fw4: {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} {{
307 (target == "helper") ? "CT helper assignment" : "CT bypass"
316 {% for (let helper in fw4.helpers()): %}
317 {% if (helper.available): %}
318 {% for (let proto in helper.proto): %}
319 ct helper {{ helper.name }} {
320 type {{ fw4.quote(helper.name, true) }} protocol {{ proto.name }};
326 {% for (let target in ["helper", "notrack"]): %}
327 {% for (let zone in fw4.zones()): %}
328 {% if (zone.dflags[target]): %}
329 chain {{ target }}_{{ zone.name }} {
330 {% for (let rule in fw4.rules(target+"_"+zone.name)): %}
331 {%+ include("rule.uc", { fw4, rule }) %}
343 chain mangle_prerouting {
344 type filter hook prerouting priority mangle; policy accept;
345 {% for (let rule in fw4.rules("mangle_prerouting")): %}
346 {%+ include("rule.uc", { fw4, rule }) %}
350 chain mangle_postrouting {
351 type filter hook postrouting priority mangle; policy accept;
352 {% for (let rule in fw4.rules("mangle_postrouting")): %}
353 {%+ include("rule.uc", { fw4, rule }) %}
358 type filter hook input priority mangle; policy accept;
359 {% for (let rule in fw4.rules("mangle_input")): %}
360 {%+ include("rule.uc", { fw4, rule }) %}
364 chain mangle_output {
365 type filter hook output priority mangle; policy accept;
366 {% for (let rule in fw4.rules("mangle_output")): %}
367 {%+ include("rule.uc", { fw4, rule }) %}
371 chain mangle_forward {
372 type filter hook forward priority mangle; policy accept;
373 {% for (let rule in fw4.rules("mangle_forward")): %}
374 {%+ include("rule.uc", { fw4, rule }) %}
376 {% for (let zone in fw4.zones()): %}
377 {% if (zone.mtu_fix): %}
378 {% for (let rule in zone.match_rules): %}
379 {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: false }) %}
380 {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: true }) %}