1 Testing the ruleset rendered from the default firewall configuration.
5 include("./root/usr/share/firewall4/main.uc", {
8 getenv: function(varname) {
28 hook ingress priority 0;
29 devices = { "br-lan", "eth1" };
42 define lan_devices = { "br-lan" }
43 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }
44 define wan_devices = { "eth1" }
45 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }
51 include "/etc/nftables.d/*.nft"
59 type filter hook input priority filter; policy accept;
61 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
63 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
64 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
65 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
66 iifname "eth1" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
70 type filter hook forward priority filter; policy drop;
72 meta l4proto { tcp, udp } flow offload @ft;
73 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
74 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
75 iifname "eth1" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
80 type filter hook output priority filter; policy accept;
82 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
84 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
85 meta l4proto tcp counter comment "!fw4: Test-Deprecated-Rule-Option"
86 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
87 oifname "eth1" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
91 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
92 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
96 limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit"
97 drop comment "!fw4: Drop excess packets"
109 jump accept_to_wan comment "!fw4: Accept lan to wan forwarding"
113 chain accept_from_lan {
114 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
117 chain accept_to_lan {
118 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
122 meta nfproto ipv4 udp dport 68 counter accept comment "!fw4: Allow-DHCP-Renew"
123 meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: Allow-Ping"
124 meta nfproto ipv4 meta l4proto igmp counter accept comment "!fw4: Allow-IGMP"
125 ip6 saddr fc00::/6 ip6 daddr fc00::/6 udp dport 546 counter accept comment "!fw4: Allow-DHCPv6"
126 ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { 130 . 0, 131 . 0, 132 . 0, 143 . 0 } counter accept comment "!fw4: Allow-MLD"
127 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3, 133, 134 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
128 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1, 135 . 0, 136 . 0 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input"
137 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
138 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward"
139 meta l4proto esp counter jump accept_to_lan comment "!fw4: Allow-IPSec-ESP"
140 udp dport 500 counter jump accept_to_lan comment "!fw4: Allow-ISAKMP"
144 chain accept_to_wan {
145 oifname "eth1" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic"
148 chain reject_from_wan {
149 iifname "eth1" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
152 chain reject_to_wan {
153 oifname "eth1" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
162 type nat hook prerouting priority dstnat; policy accept;
166 type nat hook postrouting priority srcnat; policy accept;
167 oifname "eth1" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
171 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
176 # Raw rules (notrack & helper)
179 chain raw_prerouting {
180 type filter hook prerouting priority raw; policy accept;
181 iifname "br-lan" jump helper_lan comment "!fw4: lan IPv4/IPv6 CT helper assignment"
185 type filter hook output priority raw; policy accept;
189 type "amanda" protocol udp;
193 type "ftp" protocol tcp;
197 type "RAS" protocol udp;
201 type "Q.931" protocol tcp;
205 type "irc" protocol tcp;
208 ct helper netbios-ns {
209 type "netbios-ns" protocol udp;
213 type "pptp" protocol tcp;
217 type "sane" protocol tcp;
221 type "sip" protocol udp;
225 type "snmp" protocol udp;
229 type "tftp" protocol udp;
233 type "rtsp" protocol tcp;
237 meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
238 meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
239 meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
240 meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
241 meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
242 meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
243 meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
244 meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
245 meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
246 meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
247 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
248 meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
256 chain mangle_prerouting {
257 type filter hook prerouting priority mangle; policy accept;
260 chain mangle_postrouting {
261 type filter hook postrouting priority mangle; policy accept;
265 type filter hook input priority mangle; policy accept;
268 chain mangle_output {
269 type filter hook output priority mangle; policy accept;
272 chain mangle_forward {
273 type filter hook forward priority mangle; policy accept;
274 iifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing"
275 oifname "eth1" tcp flags syn tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing"
281 [call] ctx.call object <network.interface> method <dump> args <null>
282 [call] ctx.call object <service> method <get_data> args <{ "type": "firewall" }>
283 [call] fs.open path </proc/version> mode <r>
284 [call] fs.stat path </sys/module/nf_conntrack_amanda>
285 [call] fs.stat path </sys/module/nf_conntrack_ftp>
286 [call] fs.stat path </sys/module/nf_conntrack_h323>
287 [call] fs.stat path </sys/module/nf_conntrack_h323>
288 [call] fs.stat path </sys/module/nf_conntrack_irc>
289 [call] fs.stat path </sys/module/nf_conntrack_netbios_ns>
290 [call] fs.stat path </sys/module/nf_conntrack_pptp>
291 [call] fs.stat path </sys/module/nf_conntrack_sane>
292 [call] fs.stat path </sys/module/nf_conntrack_sip>
293 [call] fs.stat path </sys/module/nf_conntrack_snmp>
294 [call] fs.stat path </sys/module/nf_conntrack_tftp>
295 [call] fs.stat path </sys/module/nf_conntrack_rtsp>
296 [!] Section @defaults[0] specifies unknown option 'unknown_defaults_option'
297 [!] Section @rule[9] (Test-Deprecated-Rule-Option) option '_name' is deprecated by fw4
298 [!] Section @rule[9] (Test-Deprecated-Rule-Option) specifies unknown option 'unknown_rule_option'
299 [call] fs.open path </sys/class/net/br-lan/flags> mode <r>
300 [call] fs.open path </sys/class/net/br-lan/flags> mode <r>