1 Test various address selection rules in redirect rules.
5 include("./root/usr/share/firewall4/main.uc", {
6 getenv: function(varname) {
16 -- File uci/helpers.json --
20 -- File uci/firewall.json --
25 "network": [ "wan", "wan6" ],
36 "network": [ "noaddr" ],
43 ".description": "Ensure unspecified family with no src, dest or rewrite address is treated as IPv4 only",
44 "name": "Redirect test #1",
53 ".description": "Ensure that explicit family any with no src, dest or rewrite address is treated as IPv4/IPv6",
54 "name": "Redirect test #2",
64 ".description": "Ensure that a DNAT without explicit dest zone infers the zone from the rewrite address",
65 "name": "Redirect test #3",
69 "dest_ip": "192.168.26.100"
72 ".description": "Ensure that external reflection source uses the src zone addr as reflection source IP",
73 "name": "Redirect test #4",
77 "dest_ip": "192.168.26.100",
78 "reflection_src": "external"
81 ".description": "Ensure that reflection is disabled if external address cannot be determined",
82 "name": "Redirect test #5",
87 "dest_ip": "192.168.26.100"
90 ".description": "Ensure that the rewrite IPv6 address is using bracket notation when a port is specified",
91 "name": "Redirect test #6",
97 "dest_ip": "2001:db8:1000:1::1234",
102 ".description": "Ensure that family restricted redirect rules work properly",
103 "name": "Redirect test #7",
113 ".description": "Ensure that family restricted redirect rules work properly",
114 "name": "Redirect test #8",
128 [!] Section @redirect[2] (Redirect test #3) does not specify a destination, assuming 'lan'
129 [!] Section @redirect[3] (Redirect test #4) does not specify a destination, assuming 'lan'
130 [!] Section @redirect[4] (Redirect test #5) external address range cannot be determined, disabling reflection
142 define wan_devices = { "pppoe-wan" }
143 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }
145 define lan_devices = { "br-lan" }
146 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }
148 define noaddr_devices = { "wwan0" }
149 define noaddr_subnets = { }
156 include "/etc/nftables.d/*.nft"
164 type filter hook input priority filter; policy drop;
166 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
168 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
169 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
170 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
171 iifname "wwan0" jump input_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 input traffic"
175 type filter hook forward priority filter; policy drop;
177 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
178 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
179 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
180 iifname "wwan0" jump forward_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 forward traffic"
184 type filter hook output priority filter; policy drop;
186 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
188 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
189 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
190 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
191 oifname "wwan0" jump output_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 output traffic"
195 type filter hook prerouting priority filter; policy accept;
198 chain handle_reject {
199 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
200 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
204 ct status dnat accept comment "!fw4: Accept port redirections"
213 ct status dnat accept comment "!fw4: Accept port forwards"
217 chain drop_from_wan {
218 iifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
222 oifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
226 ct status dnat accept comment "!fw4: Accept port redirections"
235 ct status dnat accept comment "!fw4: Accept port forwards"
239 chain accept_to_lan {
240 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
243 chain drop_from_lan {
244 iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
248 oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
252 ct status dnat accept comment "!fw4: Accept port redirections"
253 jump drop_from_noaddr
256 chain output_noaddr {
260 chain forward_noaddr {
261 ct status dnat accept comment "!fw4: Accept port forwards"
265 chain drop_from_noaddr {
266 iifname "wwan0" counter drop comment "!fw4: drop noaddr IPv4/IPv6 traffic"
269 chain drop_to_noaddr {
270 oifname "wwan0" counter drop comment "!fw4: drop noaddr IPv4/IPv6 traffic"
279 type nat hook prerouting priority dstnat; policy accept;
280 iifname "pppoe-wan" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic"
281 iifname "br-lan" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic"
282 iifname "wwan0" jump dstnat_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 dstnat traffic"
286 type nat hook postrouting priority srcnat; policy accept;
287 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
288 oifname "br-lan" jump srcnat_lan comment "!fw4: Handle lan IPv4/IPv6 srcnat traffic"
289 oifname "wwan0" jump srcnat_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 srcnat traffic"
293 meta nfproto ipv4 tcp dport 22 counter dnat 192.168.26.100:22 comment "!fw4: Redirect test #3"
294 meta nfproto ipv4 tcp dport 23 counter dnat 192.168.26.100:23 comment "!fw4: Redirect test #4"
295 meta nfproto ipv6 tcp dport 25 counter dnat [2001:db8:1000:1::1234]:25 comment "!fw4: Redirect test #6"
296 meta nfproto ipv4 tcp dport 26 counter redirect to 26 comment "!fw4: Redirect test #7"
297 meta nfproto ipv6 tcp dport 27 counter redirect to 27 comment "!fw4: Redirect test #8"
301 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
302 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 wan traffic"
306 meta nfproto ipv4 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #1"
307 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #2"
308 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 22 dnat 192.168.26.100:22 comment "!fw4: Redirect test #3 (reflection)"
309 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 23 dnat 192.168.26.100:23 comment "!fw4: Redirect test #4 (reflection)"
310 ip6 saddr { 2001:db8:1000::/60, fd63:e2f:f706::/60 } ip6 daddr 2001:db8:54:321::2 tcp dport 25 dnat [2001:db8:1000:1::1234]:25 comment "!fw4: Redirect test #6 (reflection)"
314 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 22 snat 192.168.26.1 comment "!fw4: Redirect test #3 (reflection)"
315 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 23 snat 10.11.12.194 comment "!fw4: Redirect test #4 (reflection)"
316 ip6 saddr { 2001:db8:1000::/60, fd63:e2f:f706::/60 } ip6 daddr 2001:db8:1000:1::1234 tcp dport 25 snat 2001:db8:1000:1::1 comment "!fw4: Redirect test #6 (reflection)"
319 chain dstnat_noaddr {
320 meta nfproto ipv4 tcp dport 24 counter dnat 192.168.26.100:24 comment "!fw4: Redirect test #5"
323 chain srcnat_noaddr {
324 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 noaddr traffic"
325 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 noaddr traffic"
330 # Raw rules (notrack)
333 chain raw_prerouting {
334 type filter hook prerouting priority raw; policy accept;
338 type filter hook output priority raw; policy accept;
346 chain mangle_prerouting {
347 type filter hook prerouting priority mangle; policy accept;
350 chain mangle_postrouting {
351 type filter hook postrouting priority mangle; policy accept;
355 type filter hook input priority mangle; policy accept;
358 chain mangle_output {
359 type route hook output priority mangle; policy accept;
362 chain mangle_forward {
363 type filter hook forward priority mangle; policy accept;