ruleset: reorder declarations & output tweaks

[project/firewall4.git] / tests / 01_configuration / 01_ruleset

diff --git a/tests/01_configuration/01_ruleset b/tests/01_configuration/01_ruleset
index 8621993f434e016ee9d4213e4b3071321ed000dd..dd9750cba22e14025cb438ffdcba9fccc55d5f00 100644 (file)
--- a/tests/01_configuration/01_ruleset
+++ b/tests/01_configuration/01_ruleset
@@ -30,10 +30,59 @@ table inet fw4 {
                flags offload;
        }
 
+
        #
-       # Set definitions
+       # CT helper definitions
        #
 
+       ct helper amanda {
+               type "amanda" protocol udp;
+       }
+
+       ct helper ftp {
+               type "ftp" protocol tcp;
+       }
+
+       ct helper RAS {
+               type "RAS" protocol udp;
+       }
+
+       ct helper Q.931 {
+               type "Q.931" protocol tcp;
+       }
+
+       ct helper irc {
+               type "irc" protocol tcp;
+       }
+
+       ct helper netbios-ns {
+               type "netbios-ns" protocol udp;
+       }
+
+       ct helper pptp {
+               type "pptp" protocol tcp;
+       }
+
+       ct helper sane {
+               type "sane" protocol tcp;
+       }
+
+       ct helper sip {
+               type "sip" protocol udp;
+       }
+
+       ct helper snmp {
+               type "snmp" protocol udp;
+       }
+
+       ct helper tftp {
+               type "tftp" protocol udp;
+       }
+
+       ct helper rtsp {
+               type "rtsp" protocol tcp;
+       }
+
 
        #
        # Defines
@@ -41,9 +90,11 @@ table inet fw4 {
 
        define lan_devices = { "br-lan" }
        define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }
+
        define wan_devices = { "pppoe-wan" }
        define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }
 
+
        #
        # User includes
        #
@@ -87,6 +138,11 @@ table inet fw4 {
                oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
        }
 
+       chain prerouting {
+               type filter hook prerouting priority filter; policy accept;
+               iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment"
+       }
+
        chain handle_reject {
                meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
                reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
@@ -110,6 +166,21 @@ table inet fw4 {
                jump accept_to_lan
        }
 
+       chain helper_lan {
+               meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
+               meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
+               meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
+               meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
+               meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
+               meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
+               meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
+               meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
+               meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
+               meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
+               meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
+               meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
+       }
+
        chain accept_from_lan {
                iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
        }
@@ -173,81 +244,17 @@ table inet fw4 {
 
 
        #
-       # Raw rules (notrack & helper)
+       # Raw rules (notrack)
        #
 
        chain raw_prerouting {
                type filter hook prerouting priority raw; policy accept;
-               iifname "br-lan" jump helper_lan comment "!fw4: lan IPv4/IPv6 CT helper assignment"
        }
 
        chain raw_output {
                type filter hook output priority raw; policy accept;
        }
 
-       ct helper amanda {
-               type "amanda" protocol udp;
-       }
-
-       ct helper ftp {
-               type "ftp" protocol tcp;
-       }
-
-       ct helper RAS {
-               type "RAS" protocol udp;
-       }
-
-       ct helper Q.931 {
-               type "Q.931" protocol tcp;
-       }
-
-       ct helper irc {
-               type "irc" protocol tcp;
-       }
-
-       ct helper netbios-ns {
-               type "netbios-ns" protocol udp;
-       }
-
-       ct helper pptp {
-               type "pptp" protocol tcp;
-       }
-
-       ct helper sane {
-               type "sane" protocol tcp;
-       }
-
-       ct helper sip {
-               type "sip" protocol udp;
-       }
-
-       ct helper snmp {
-               type "snmp" protocol udp;
-       }
-
-       ct helper tftp {
-               type "tftp" protocol udp;
-       }
-
-       ct helper rtsp {
-               type "rtsp" protocol tcp;
-       }
-
-       chain helper_lan {
-               meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
-               meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
-               meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
-               meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
-               meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
-               meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
-               meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
-               meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
-               meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
-               meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
-               meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
-               meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
-       }
-
 
        #
        # Mangle rules