1 Testing that zone policies are properly mapped to chains.
5 include("./root/usr/share/firewall4/main.uc", {
6 getenv: function(varname) {
16 -- File uci/helpers.json --
20 -- File fs/open~_sys_class_net_zone1_flags.txt --
24 -- File fs/open~_sys_class_net_zone2_flags.txt --
28 -- File fs/open~_sys_class_net_zone3_flags.txt --
32 -- File uci/firewall.json --
36 ".description": "Zone accept policies should map to accept rules from/to covered interfaces",
44 ".description": "Zone drop policies should map to drop rules from/to covered interfaces",
52 ".description": "Zone reject policies should map to reject rules from/to covered interfaces",
72 define test1_devices = { "zone1" }
73 define test1_subnets = { }
75 define test2_devices = { "zone2" }
76 define test2_subnets = { }
78 define test3_devices = { "zone3" }
79 define test3_subnets = { }
86 include "/etc/nftables.d/*.nft"
94 type filter hook input priority filter; policy drop;
96 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
98 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
99 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
100 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
101 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
105 type filter hook forward priority filter; policy drop;
107 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
108 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
109 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
110 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
114 type filter hook output priority filter; policy drop;
116 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
118 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
119 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
120 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
121 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
125 type filter hook prerouting priority filter; policy accept;
126 iifname "zone1" jump helper_test1 comment "!fw4: Handle test1 IPv4/IPv6 helper assignment"
127 iifname "zone2" jump helper_test2 comment "!fw4: Handle test2 IPv4/IPv6 helper assignment"
128 iifname "zone3" jump helper_test3 comment "!fw4: Handle test3 IPv4/IPv6 helper assignment"
131 chain handle_reject {
132 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
133 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
137 jump accept_from_test1
144 chain forward_test1 {
151 chain accept_from_test1 {
152 iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
155 chain accept_to_test1 {
156 oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
167 chain forward_test2 {
174 chain drop_from_test2 {
175 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
178 chain drop_to_test2 {
179 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
183 jump reject_from_test3
190 chain forward_test3 {
197 chain reject_from_test3 {
198 iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
201 chain reject_to_test3 {
202 oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
211 type nat hook prerouting priority dstnat; policy accept;
215 type nat hook postrouting priority srcnat; policy accept;
220 # Raw rules (notrack)
223 chain raw_prerouting {
224 type filter hook prerouting priority raw; policy accept;
228 type filter hook output priority raw; policy accept;
236 chain mangle_prerouting {
237 type filter hook prerouting priority mangle; policy accept;
240 chain mangle_postrouting {
241 type filter hook postrouting priority mangle; policy accept;
245 type filter hook input priority mangle; policy accept;
248 chain mangle_output {
249 type route hook output priority mangle; policy accept;
252 chain mangle_forward {
253 type filter hook forward priority mangle; policy accept;