1 Test that the zone family is honoured when setting up inter-zone forwarding rules.
5 include("./root/usr/share/firewall4/main.uc", {
6 getenv: function(varname) {
16 -- File uci/helpers.json --
20 -- File uci/firewall.json --
44 ".description": "This should only allow IPv6 forwarding from lan to wanA",
51 ".description": "This should only allow IPv4 forwarding from lan to wanB",
69 define wanA_devices = { "eth0" }
70 define wanA_subnets = { }
72 define wanB_devices = { "eth1" }
73 define wanB_subnets = { }
75 define lan_devices = { "eth2" }
76 define lan_subnets = { }
83 include "/etc/nftables.d/*.nft"
91 type filter hook input priority filter; policy drop;
93 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
95 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
96 iifname "eth0" jump input_wanA comment "!fw4: Handle wanA IPv4/IPv6 input traffic"
97 iifname "eth1" jump input_wanB comment "!fw4: Handle wanB IPv4/IPv6 input traffic"
98 iifname "eth2" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
102 type filter hook forward priority filter; policy drop;
104 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
105 iifname "eth0" jump forward_wanA comment "!fw4: Handle wanA IPv4/IPv6 forward traffic"
106 iifname "eth1" jump forward_wanB comment "!fw4: Handle wanB IPv4/IPv6 forward traffic"
107 iifname "eth2" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
111 type filter hook output priority filter; policy drop;
113 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
115 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
116 oifname "eth0" jump output_wanA comment "!fw4: Handle wanA IPv4/IPv6 output traffic"
117 oifname "eth1" jump output_wanB comment "!fw4: Handle wanB IPv4/IPv6 output traffic"
118 oifname "eth2" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
122 type filter hook prerouting priority filter; policy accept;
125 chain handle_reject {
126 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
127 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
142 chain accept_to_wanA {
143 oifname "eth0" counter accept comment "!fw4: accept wanA IPv4/IPv6 traffic"
146 chain drop_from_wanA {
147 iifname "eth0" counter drop comment "!fw4: drop wanA IPv4/IPv6 traffic"
151 oifname "eth0" counter drop comment "!fw4: drop wanA IPv4/IPv6 traffic"
166 chain accept_to_wanB {
167 oifname "eth1" counter accept comment "!fw4: accept wanB IPv4/IPv6 traffic"
170 chain drop_from_wanB {
171 iifname "eth1" counter drop comment "!fw4: drop wanB IPv4/IPv6 traffic"
175 oifname "eth1" counter drop comment "!fw4: drop wanB IPv4/IPv6 traffic"
187 meta nfproto ipv6 jump accept_to_wanA comment "!fw4: Accept lan to wanA IPv6 forwarding"
188 meta nfproto ipv4 jump accept_to_wanB comment "!fw4: Accept lan to wanB IPv4 forwarding"
192 chain drop_from_lan {
193 iifname "eth2" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
197 oifname "eth2" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
206 type nat hook prerouting priority dstnat; policy accept;
210 type nat hook postrouting priority srcnat; policy accept;
215 # Raw rules (notrack)
218 chain raw_prerouting {
219 type filter hook prerouting priority raw; policy accept;
223 type filter hook output priority raw; policy accept;
231 chain mangle_prerouting {
232 type filter hook prerouting priority mangle; policy accept;
235 chain mangle_postrouting {
236 type filter hook postrouting priority mangle; policy accept;
240 type filter hook input priority mangle; policy accept;
243 chain mangle_output {
244 type route hook output priority mangle; policy accept;
247 chain mangle_forward {
248 type filter hook forward priority mangle; policy accept;