1 Test that the zone family is honoured when setting up inter-zone forwarding rules.
5 include("./root/usr/share/firewall4/main.uc", {
6 getenv: function(varname) {
16 -- File uci/helpers.json --
20 -- File uci/firewall.json --
44 ".description": "This should only allow IPv6 forwarding from lan to wanA",
51 ".description": "This should only allow IPv4 forwarding from lan to wanB",
74 define wanA_devices = { "eth0" }
75 define wanB_devices = { "eth1" }
76 define lan_devices = { "eth2" }
82 include "/etc/nftables.d/*.nft"
90 type filter hook input priority filter; policy drop;
92 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
94 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
95 iifname "eth0" jump input_wanA comment "!fw4: Handle wanA IPv4/IPv6 input traffic"
96 iifname "eth1" jump input_wanB comment "!fw4: Handle wanB IPv4/IPv6 input traffic"
97 iifname "eth2" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
101 type filter hook forward priority filter; policy drop;
103 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
104 iifname "eth0" jump forward_wanA comment "!fw4: Handle wanA IPv4/IPv6 forward traffic"
105 iifname "eth1" jump forward_wanB comment "!fw4: Handle wanB IPv4/IPv6 forward traffic"
106 iifname "eth2" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
110 type filter hook output priority filter; policy drop;
112 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
114 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
115 oifname "eth0" jump output_wanA comment "!fw4: Handle wanA IPv4/IPv6 output traffic"
116 oifname "eth1" jump output_wanB comment "!fw4: Handle wanB IPv4/IPv6 output traffic"
117 oifname "eth2" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
120 chain handle_reject {
121 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
122 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
137 chain accept_to_wanA {
138 oifname "eth0" counter accept comment "!fw4: accept wanA IPv4/IPv6 traffic"
141 chain drop_from_wanA {
142 iifname "eth0" counter drop comment "!fw4: drop wanA IPv4/IPv6 traffic"
146 oifname "eth0" counter drop comment "!fw4: drop wanA IPv4/IPv6 traffic"
161 chain accept_to_wanB {
162 oifname "eth1" counter accept comment "!fw4: accept wanB IPv4/IPv6 traffic"
165 chain drop_from_wanB {
166 iifname "eth1" counter drop comment "!fw4: drop wanB IPv4/IPv6 traffic"
170 oifname "eth1" counter drop comment "!fw4: drop wanB IPv4/IPv6 traffic"
182 meta nfproto ipv6 jump accept_to_wanA comment "!fw4: Accept lan to wanA IPv6 forwarding"
183 meta nfproto ipv4 jump accept_to_wanB comment "!fw4: Accept lan to wanB IPv4 forwarding"
187 chain drop_from_lan {
188 iifname "eth2" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
192 oifname "eth2" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
201 type nat hook prerouting priority dstnat; policy accept;
205 type nat hook postrouting priority srcnat; policy accept;
210 # Raw rules (notrack & helper)
213 chain raw_prerouting {
214 type filter hook prerouting priority raw; policy accept;
218 type filter hook output priority raw; policy accept;
226 chain mangle_prerouting {
227 type filter hook prerouting priority mangle; policy accept;
230 chain mangle_postrouting {
231 type filter hook postrouting priority mangle; policy accept;
235 type filter hook input priority mangle; policy accept;
238 chain mangle_output {
239 type route hook output priority mangle; policy accept;
242 chain mangle_forward {
243 type filter hook forward priority mangle; policy accept;