root/usr/share/firewall4/templates/ruleset.uc

   1 table inet fw4
   2 flush table inet fw4
   3
   4 table inet fw4 {
   5         #
   6         # Set definitions
   7         #
   8
   9 {% for (let set in fw4.ipsets()): %}
  10         set {{ set.name }} {
  11                 type {{ fw4.concat(set.types) }}
  12 {%  if (set.maxelem > 0): %}
  13                 size {{ set.maxelem }}
  14 {%  endif %}
  15 {%  if (set.interval): %}
  16                 flags interval
  17 {%  endif %}
  18 {%  fw4.print_setentries(set) %}
  19         }
  20
  21 {% endfor %}
  22
  23         #
  24         # Defines
  25         #
  26
  27 {% for (let zone in fw4.zones()): %}
  28 {%  if (length(zone.match_devices)): %}
  29         define {{ zone.name }}_devices = {{ fw4.set(zone.match_devices, true) }}
  30 {%  endif %}
  31 {%  if (length(zone.match_subnets)): %}
  32         define {{ zone.name }}_subnets = {{ fw4.set(zone.match_subnets, true) }}
  33 {%  endif %}
  34
  35 {% endfor %}
  36
  37         #
  38         # User includes
  39         #
  40
  41         include "/etc/nftables.d/*.nft"
  42
  43
  44         #
  45         # Filter rules
  46         #
  47
  48         chain input {
  49                 type filter hook input priority filter; policy {{ fw4.input_policy(true) }};
  50
  51                 iifname "lo" accept comment "!fw4: Accept traffic from loopback"
  52
  53                 ct state established,related accept comment "!fw4: Allow inbound established and related flows"
  54
  55 {% if (fw4.default_option("drop_invalid")): %}
  56                 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
  57 {% endif %}
  58
  59 {% if (fw4.default_option("synflood_protect")): %}
  60                 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
  61 {% endif %}
  62
  63 {% for (local rule in fw4.rules("input")): %}
  64                 {%+ include("rule.uc", { fw4, rule }) %}
  65 {% endfor %}
  66
  67 {% for (local zone in fw4.zones()): for (local rule in zone.match_rules): %}
  68                 {%+ include("zone-match.uc", { fw4, zone, rule, direction: "input" }) %}
  69 {% endfor; endfor %}
  70
  71 {% if (fw4.input_policy() == "reject"): %}
  72                 jump handle_reject
  73 {% endif %}
  74         }
  75
  76         chain forward {
  77                 type filter hook forward priority filter; policy {{ fw4.forward_policy(true) }};
  78
  79                 ct state established,related accept comment "!fw4: Allow forwarded established and related flows"
  80
  81 {% if (fw4.default_option("drop_invalid")): %}
  82                 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
  83 {% endif %}
  84
  85 {% for (local rule in fw4.rules("forward")): %}
  86                 {%+ include("rule.uc", { fw4, rule }) %}
  87 {% endfor %}
  88
  89 {% for (local zone in fw4.zones()): for (local rule in zone.match_rules): %}
  90                 {%+ include("zone-match.uc", { fw4, zone, rule, direction: "forward" }) %}
  91 {% endfor; endfor %}
  92
  93 {% if (fw4.forward_policy() == "reject"): %}
  94                 jump handle_reject
  95 {% endif %}
  96         }
  97
  98         chain output {
  99                 type filter hook output priority filter; policy {{ fw4.output_policy(true) }};
 100
 101                 oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
 102
 103                 ct state established,related accept comment "!fw4: Allow outbound established and related flows"
 104
 105 {% if (fw4.default_option("drop_invalid")): %}
 106                 ct state invalid drop comment "!fw4: Drop flows with invalid conntrack state"
 107 {% endif %}
 108
 109 {% for (local rule in fw4.rules("output")): %}
 110                 {%+ include("rule.uc", { fw4, rule }) %}
 111 {% endfor %}
 112
 113 {% for (local zone in fw4.zones()): for (local rule in zone.match_rules): %}
 114                 {%+ include("zone-match.uc", { fw4, zone, rule, direction: "output" }) %}
 115 {% endfor; endfor %}
 116
 117 {% if (fw4.output_policy() == "reject"): %}
 118                 jump handle_reject
 119 {% endif %}
 120         }
 121
 122         chain handle_reject {
 123                 meta l4proto tcp reject with {{
 124                         (fw4.default_option("tcp_reject_code") != "tcp-reset")
 125                                 ? "icmpx type " + fw4.default_option("tcp_reject_code")
 126                                 : "tcp reset"
 127                 }} comment "!fw4: Reject TCP traffic"
 128                 reject with {{
 129                         (fw4.default_option("any_reject_code") != "tcp-reset")
 130                                 ? "icmpx type " + fw4.default_option("any_reject_code")
 131                                 : "tcp reset"
 132                 }} comment "!fw4: Reject any other traffic"
 133         }
 134
 135 {% if (fw4.default_option("synflood_protect")):
 136         local r = fw4.default_option("synflood_rate");
 137         local b = fw4.default_option("synflood_burst");
 138 %}
 139         chain syn_flood {
 140                 tcp flags & (fin | syn | rst | ack) == syn
 141                 {%- if (r): %} limit rate {{ r.rate }}/{{ r.unit }}{% endif %}
 142                 {%- if (b): %} burst {{ b }} packets{% endif %} return comment "!fw4: Accept SYN packets below rate-limit"
 143                 drop comment "!fw4: Drop excess packets"
 144         }
 145
 146 {% endif %}
 147
 148 {% for (local zone in fw4.zones()): %}
 149         chain input_{{ zone.name }} {
 150 {%  for (local rule in fw4.rules("input_"+zone.name)): %}
 151                 {%+ include("rule.uc", { fw4, rule }) %}
 152 {%  endfor %}
 153 {%  if (zone.dflags.dnat): %}
 154                 ct status dnat accept comment "!fw4: Accept port redirections"
 155 {%  endif %}
 156                 jump {{ zone.input }}_from_{{ zone.name }}
 157         }
 158
 159         chain output_{{ zone.name }} {
 160 {%  for (local rule in fw4.rules("output_"+zone.name)): %}
 161                 {%+ include("rule.uc", { fw4, rule }) %}
 162 {%  endfor %}
 163                 jump {{ zone.output }}_to_{{ zone.name }}
 164         }
 165
 166         chain forward_{{ zone.name }} {
 167 {%  for (local rule in fw4.rules("forward_"+zone.name)): %}
 168                 {%+ include("rule.uc", { fw4, rule }) %}
 169 {%  endfor %}
 170 {%  if (zone.dflags.dnat): %}
 171                 ct status dnat accept comment "!fw4: Accept port forwards"
 172 {%  endif %}
 173                 jump {{ zone.forward }}_to_{{ zone.name }}
 174         }
 175
 176 {%  for (local verdict in ["accept", "reject", "drop"]): %}
 177 {%   if (zone.sflags[verdict]): %}
 178         chain {{ verdict }}_from_{{ zone.name }} {
 179 {%    for (local rule in zone.match_rules): %}
 180                 {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: false, verdict }) %}
 181 {%    endfor %}
 182         }
 183
 184 {%   endif %}
 185 {%   if (zone.dflags[verdict]): %}
 186         chain {{ verdict }}_to_{{ zone.name }} {
 187 {%   for (local rule in zone.match_rules): %}
 188                 {%+ include("zone-verdict.uc", { fw4, zone, rule, egress: true, verdict }) %}
 189 {%   endfor %}
 190         }
 191
 192 {%   endif %}
 193 {%  endfor %}
 194 {% endfor %}
 195
 196
 197         #
 198         # NAT rules
 199         #
 200
 201         chain dstnat {
 202                 type nat hook prerouting priority dstnat; policy accept;
 203
 204 {% for (let zone in fw4.zones()): %}
 205 {%  if (zone.dflags.dnat): %}
 206 {%   for (let rule in zone.match_rules): %}
 207                 {%+ include("zone-match.uc", { fw4, zone, rule, direction: "dstnat" }) %}
 208 {%   endfor %}
 209 {%  endif %}
 210 {% endfor %}
 211         }
 212
 213         chain srcnat {
 214                 type nat hook postrouting priority srcnat; policy accept;
 215
 216 {% for (let redirect in fw4.redirects("srcnat")): %}
 217                 {%+ include("redirect.uc", { fw4, redirect }) %}
 218 {% endfor %}
 219 {% for (let zone in fw4.zones()): %}
 220 {%  if (zone.dflags.snat): %}
 221 {%   for (let rule in zone.match_rules): %}
 222                 {%+ include("zone-match.uc", { fw4, zone, rule, direction: "srcnat" }) %}
 223 {%   endfor %}
 224 {%  endif %}
 225 {% endfor %}
 226         }
 227
 228 {% for (let zone in fw4.zones()): %}
 229 {%  if (zone.dflags.dnat): %}
 230         chain dstnat_{{ zone.name }} {
 231 {% for (let redirect in fw4.redirects("dstnat_"+zone.name)): %}
 232                 {%+ include("redirect.uc", { fw4, redirect }) %}
 233 {% endfor %}
 234         }
 235
 236 {%  endif %}
 237 {%  if (zone.dflags.snat): %}
 238         chain srcnat_{{ zone.name }} {
 239 {% for (let redirect in fw4.redirects("srcnat_"+zone.name)): %}
 240                 {%+ include("redirect.uc", { fw4, redirect }) %}
 241 {% endfor %}
 242 {%   if (zone.masq): %}
 243                 meta nfproto ipv4 {%+ if (zone.masq4_src_pos): -%}
 244                         ip saddr {{ fw4.set(zone.masq4_src_pos) }} {%+ endif -%}
 245                 {%+ if (zone.masq4_src_neg): -%}
 246                         ip saddr != {{ fw4.set(zone.masq4_src_neg) }} {%+ endif -%}
 247                 {%+ if (zone.masq4_dest_pos): -%}
 248                         ip daddr {{ fw4.set(zone.masq4_dest_pos) }} {%+ endif -%}
 249                 {%+ if (zone.masq4_dest_neg): -%}
 250                         ip daddr != {{ fw4.set(zone.masq4_dest_neg) }} {%+ endif -%}
 251                 masquerade comment "!fw4: Masquerade IPv4 {{ zone.name }} traffic"
 252 {%   endif %}
 253 {%   if (zone.masq6): %}
 254                 meta nfproto ipv6 {%+ if (zone.masq6_src_pos): -%}
 255                         ip6 saddr {{ fw4.set(zone.masq6_src_pos) }} {%+ endif -%}
 256                 {%+ if (zone.masq6_src_neg): -%}
 257                         ip6 saddr != {{ fw4.set(zone.masq6_src_neg) }} {%+ endif -%}
 258                 {%+ if (zone.masq6_dest_pos): -%}
 259                         ip6 daddr {{ fw4.set(zone.masq6_dest_pos) }} {%+ endif -%}
 260                 {%+ if (zone.masq6_dest_neg): -%}
 261                         ip6 daddr != {{ fw4.set(zone.masq6_dest_neg) }} {%+ endif -%}
 262                 masquerade comment "!fw4: Masquerade IPv6 {{ zone.name }} traffic"
 263 {%   endif %}
 264         }
 265
 266 {%  endif %}
 267 {% endfor %}
 268
 269         #
 270         # Raw rules (notrack & helper)
 271         #
 272
 273         chain raw_prerouting {
 274                 type filter hook prerouting priority raw; policy accept;
 275
 276 {% for (let target in ["helper", "notrack"]): %}
 277 {%  for (let zone in fw4.zones()): %}
 278 {%   if (zone.dflags[target]): %}
 279 {%    for (let rule in zone.match_rules): %}
 280 {%     let devs = fw4.filter_loopback_devs(rule.devices_pos, false); %}
 281 {%     let nets = fw4.filter_loopback_addrs(rule.subnets_pos, false); %}
 282 {%     if (rule.devices_neg || rule.subnets_neg || length(devs) || length(nets)): %}
 283                 {%+ if (rule.family): -%}
 284                         meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
 285                 {%+ if (length(devs)): -%}
 286                         iifname {{ fw4.set(devs) }} {%+ endif -%}
 287                 {%+ if (rule.devices_neg): -%}
 288                         iifname != {{ fw4.set(rule.devices_neg) }} {%+ endif -%}
 289                 {%+ if (length(nets)): -%}
 290                         {{ fw4.ipproto(rule.family) }} saddr {{ fw4.set(nets) }} {%+ endif -%}
 291                 {%+ if (rule.subnets_neg): -%}
 292                         {{ fw4.ipproto(rule.family) }} saddr != {{ fw4.set(rule.subnets_neg) }} {%+ endif -%}
 293                 jump {{ target }}_{{ zone.name }} comment "!fw4: {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} {{
 294                         (target == "helper") ? "CT helper assignment" : "CT bypass"
 295                 }}"
 296 {%     endif %}
 297 {%    endfor %}
 298 {%   endif %}
 299 {%  endfor %}
 300 {% endfor %}
 301         }
 302
 303         chain raw_output {
 304                 type filter hook output priority raw; policy accept;
 305
 306 {% for (let target in ["helper", "notrack"]): %}
 307 {%  for (let zone in fw4.zones()): %}
 308 {%   if (zone.dflags[target]): %}
 309 {%    for (let rule in zone.match_rules): %}
 310 {%     let devs = fw4.filter_loopback_devs(rule.devices_pos, true); %}
 311 {%     let nets = fw4.filter_loopback_addrs(rule.subnets_pos, true); %}
 312 {%     if (length(devs) || length(nets)): %}
 313                 {%+ if (rule.family): -%}
 314                         meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
 315                 {%+ if (length(devs)): -%}
 316                         iifname {{ fw4.set(devs) }} {%+ endif -%}
 317                 {%+ if (length(nets)): -%}
 318                         {{ fw4.ipproto(rule.family) }} saddr {{ fw4.set(nets) }} {%+ endif -%}
 319                 jump {{ target }}_{{ zone.name }} comment "!fw4: {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} {{
 320                         (target == "helper") ? "CT helper assignment" : "CT bypass"
 321                 }}"
 322 {%     endif %}
 323 {%    endfor %}
 324 {%   endif %}
 325 {%  endfor %}
 326 {% endfor %}
 327         }
 328
 329 {% for (let helper in fw4.helpers()): %}
 330 {%  if (helper.available): %}
 331 {%   for (let proto in helper.proto): %}
 332         ct helper {{ helper.name }} {
 333                 type {{ fw4.quote(helper.name, true) }} protocol {{ proto.name }};
 334         }
 335
 336 {%   endfor %}
 337 {%  endif %}
 338 {% endfor %}
 339
 340 {% for (let target in ["helper", "notrack"]): %}
 341 {%  for (let zone in fw4.zones()): %}
 342 {%   if (zone.dflags[target]): %}
 343         chain {{ target }}_{{ zone.name }} {
 344 {% for (let rule in fw4.rules(target+"_"+zone.name)): %}
 345                 {%+ include("rule.uc", { fw4, rule }) %}
 346 {% endfor %}
 347         }
 348
 349 {%   endif %}
 350 {%  endfor %}
 351 {% endfor %}
 352
 353
 354         #
 355         # Mangle rules
 356         #
 357
 358         chain mangle_prerouting {
 359                 type filter hook prerouting priority mangle; policy accept;
 360
 361 {% for (let rule in fw4.rules("mangle_prerouting")): %}
 362                 {%+ include("rule.uc", { fw4, rule }) %}
 363 {% endfor %}
 364         }
 365
 366         chain mangle_output {
 367                 type filter hook output priority mangle; policy accept;
 368
 369 {% for (let rule in fw4.rules("mangle_output")): %}
 370                 {%+ include("rule.uc", { fw4, rule }) %}
 371 {% endfor %}
 372         }
 373
 374         chain mangle_forward {
 375                 type filter hook forward priority mangle; policy accept;
 376
 377 {% for (let zone in fw4.zones()): %}
 378 {%  if (zone.mtu_fix): %}
 379 {%   for (let rule in zone.match_rules): %}
 380                 {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: false }) %}
 381                 {%+ include("zone-mssfix.uc", { fw4, zone, rule, egress: true }) %}
 382 {%   endfor %}
 383 {%  endif %}
 384 {% endfor %}
 385         }
 386 }