1 Testing that zone masquerading is properly mapped to chains.
5 include("./root/usr/share/firewall4/main.uc", {
6 getenv: function(varname) {
16 -- File uci/helpers.json --
20 -- File fs/open~_sys_class_net_zone1_flags.txt --
24 -- File fs/open~_sys_class_net_zone2_flags.txt --
28 -- File fs/open~_sys_class_net_zone3_flags.txt --
32 -- File uci/firewall.json --
36 ".description": "Setting masq to true should emit an IPv4 masquerading rule and inhibit default helper assignment",
45 ".description": "Setting masq6 to true should emit an IPv6 masquerading rule and inhibit default helper assignment",
54 ".description": "Setting both masq and masq6 should emit IPv4 and IPv6 masquerading and inhibit default helper assignment",
81 define test1_devices = { "zone1" }
82 define test2_devices = { "zone2" }
83 define test3_devices = { "zone3" }
89 include "/etc/nftables.d/*.nft"
97 type filter hook input priority filter; policy drop;
99 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
101 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
102 iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
103 iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
104 iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
108 type filter hook forward priority filter; policy drop;
110 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
111 iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
112 iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
113 iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
117 type filter hook output priority filter; policy drop;
119 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
121 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
122 oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
123 oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
124 oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
127 chain handle_reject {
128 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
129 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
133 jump accept_from_test1
140 chain forward_test1 {
144 chain accept_from_test1 {
145 iifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
148 chain accept_to_test1 {
149 oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
160 chain forward_test2 {
164 chain drop_from_test2 {
165 iifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
168 chain drop_to_test2 {
169 oifname "zone2" counter drop comment "!fw4: drop test2 IPv4/IPv6 traffic"
173 jump reject_from_test3
180 chain forward_test3 {
184 chain reject_from_test3 {
185 iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
188 chain reject_to_test3 {
189 oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
198 type nat hook prerouting priority dstnat; policy accept;
202 type nat hook postrouting priority srcnat; policy accept;
203 oifname "zone1" jump srcnat_test1 comment "!fw4: Handle test1 IPv4/IPv6 srcnat traffic"
204 oifname "zone2" jump srcnat_test2 comment "!fw4: Handle test2 IPv4/IPv6 srcnat traffic"
205 oifname "zone3" jump srcnat_test3 comment "!fw4: Handle test3 IPv4/IPv6 srcnat traffic"
209 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 test1 traffic"
213 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 test2 traffic"
217 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 test3 traffic"
218 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 test3 traffic"
223 # Raw rules (notrack & helper)
226 chain raw_prerouting {
227 type filter hook prerouting priority raw; policy accept;
231 type filter hook output priority raw; policy accept;
239 chain mangle_prerouting {
240 type filter hook prerouting priority mangle; policy accept;
243 chain mangle_postrouting {
244 type filter hook postrouting priority mangle; policy accept;
248 type filter hook input priority mangle; policy accept;
251 chain mangle_output {
252 type route hook output priority mangle; policy accept;
255 chain mangle_forward {
256 type filter hook forward priority mangle; policy accept;