ruleset: dispatch ct states using verdict map

[project/firewall4.git] / tests / 02_zones / 02_masq

diff --git a/tests/02_zones/02_masq b/tests/02_zones/02_masq
index 69f37d4c318416b7b24685c53131b9a42ae81c46..35d3cbc3dac4ea8defa93a16cb426a249fe5b3b6 100644 (file)
--- a/tests/02_zones/02_masq
+++ b/tests/02_zones/02_masq
@@ -69,18 +69,19 @@ table inet fw4
 flush table inet fw4
 
 table inet fw4 {
-       #
-       # Set definitions
-       #
-
-
        #
        # Defines
        #
 
        define test1_devices = { "zone1" }
+       define test1_subnets = {  }
+
        define test2_devices = { "zone2" }
+       define test2_subnets = {  }
+
        define test3_devices = { "zone3" }
+       define test3_subnets = {  }
+
 
        #
        # User includes
@@ -98,7 +99,7 @@ table inet fw4 {
 
                iifname "lo" accept comment "!fw4: Accept traffic from loopback"
 
-               ct state established,related accept comment "!fw4: Allow inbound established and related flows"
+               ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
                iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
                iifname "zone2" jump input_test2 comment "!fw4: Handle test2 IPv4/IPv6 input traffic"
                iifname "zone3" jump input_test3 comment "!fw4: Handle test3 IPv4/IPv6 input traffic"
@@ -107,7 +108,7 @@ table inet fw4 {
        chain forward {
                type filter hook forward priority filter; policy drop;
 
-               ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
+               ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
                iifname "zone1" jump forward_test1 comment "!fw4: Handle test1 IPv4/IPv6 forward traffic"
                iifname "zone2" jump forward_test2 comment "!fw4: Handle test2 IPv4/IPv6 forward traffic"
                iifname "zone3" jump forward_test3 comment "!fw4: Handle test3 IPv4/IPv6 forward traffic"
@@ -118,12 +119,16 @@ table inet fw4 {
 
                oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 
-               ct state established,related accept comment "!fw4: Allow outbound established and related flows"
+               ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
                oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
                oifname "zone2" jump output_test2 comment "!fw4: Handle test2 IPv4/IPv6 output traffic"
                oifname "zone3" jump output_test3 comment "!fw4: Handle test3 IPv4/IPv6 output traffic"
        }
 
+       chain prerouting {
+               type filter hook prerouting priority filter; policy accept;
+       }
+
        chain handle_reject {
                meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
                reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
@@ -146,6 +151,7 @@ table inet fw4 {
        }
 
        chain accept_to_test1 {
+               meta nfproto ipv4 oifname "zone1" ct state invalid counter drop comment "!fw4: Prevent NAT leakage"
                oifname "zone1" counter accept comment "!fw4: accept test1 IPv4/IPv6 traffic"
        }
 
@@ -220,7 +226,7 @@ table inet fw4 {
 
 
        #
-       # Raw rules (notrack & helper)
+       # Raw rules (notrack)
        #
 
        chain raw_prerouting {
@@ -240,8 +246,16 @@ table inet fw4 {
                type filter hook prerouting priority mangle; policy accept;
        }
 
+       chain mangle_postrouting {
+               type filter hook postrouting priority mangle; policy accept;
+       }
+
+       chain mangle_input {
+               type filter hook input priority mangle; policy accept;
+       }
+
        chain mangle_output {
-               type filter hook output priority mangle; policy accept;
+               type route hook output priority mangle; policy accept;
        }
 
        chain mangle_forward {