Install conntrack state invalid drop rules to catch outgoing, un-natted
traffic in zones with enabled masquerading.
Also introduce a new option "masq_allow_invalid" it inhibit this new
drop rules.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
const char *extra_dest;
bool masq;
const char *extra_dest;
bool masq;
+ bool masq_allow_invalid;
struct list_head masq_src;
struct list_head masq_dest;
struct list_head masq_src;
struct list_head masq_dest;
FW3_OPT("output", target, zone, policy_output),
FW3_OPT("masq", bool, zone, masq),
FW3_OPT("output", target, zone, policy_output),
FW3_OPT("masq", bool, zone, masq),
+ FW3_OPT("masq_allow_invalid", bool, zone, masq_allow_invalid),
FW3_LIST("masq_src", network, zone, masq_src),
FW3_LIST("masq_dest", network, zone, masq_dest),
FW3_LIST("masq_src", network, zone, masq_src),
FW3_LIST("masq_dest", network, zone, masq_dest),
if (has(zone->flags, handle->family, t))
{
if (has(zone->flags, handle->family, t))
{
+ if (t == FW3_FLAG_ACCEPT &&
+ zone->masq && !zone->masq_allow_invalid)
+ {
+ r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
+ fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
+ fw3_ipt_rule_comment(r, "Prevent NAT leakage");
+ fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_DROP]);
+ fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
+ fw3_flag_names[t]);
+ }
+
r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
fw3_ipt_rule_target(r, jump_target(t));
fw3_ipt_rule_extra(r, zone->extra_dest);
r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
fw3_ipt_rule_target(r, jump_target(t));
fw3_ipt_rule_extra(r, zone->extra_dest);