ruleset: fix conntrack helpers

[project/firewall4.git] / tests / 01_configuration / 01_ruleset

diff --git a/tests/01_configuration/01_ruleset b/tests/01_configuration/01_ruleset
index 8621993f434e016ee9d4213e4b3071321ed000dd..cd32edceca5cc584b191758bb43f3b50dd0b16f2 100644 (file)
--- a/tests/01_configuration/01_ruleset
+++ b/tests/01_configuration/01_ruleset
@@ -30,6 +30,59 @@ table inet fw4 {
                flags offload;
        }
 
+       #
+       # CT helper definitions
+       #
+
+       ct helper amanda {
+               type "amanda" protocol udp;
+       }
+
+       ct helper ftp {
+               type "ftp" protocol tcp;
+       }
+
+       ct helper RAS {
+               type "RAS" protocol udp;
+       }
+
+       ct helper Q.931 {
+               type "Q.931" protocol tcp;
+       }
+
+       ct helper irc {
+               type "irc" protocol tcp;
+       }
+
+       ct helper netbios-ns {
+               type "netbios-ns" protocol udp;
+       }
+
+       ct helper pptp {
+               type "pptp" protocol tcp;
+       }
+
+       ct helper sane {
+               type "sane" protocol tcp;
+       }
+
+       ct helper sip {
+               type "sip" protocol udp;
+       }
+
+       ct helper snmp {
+               type "snmp" protocol udp;
+       }
+
+       ct helper tftp {
+               type "tftp" protocol udp;
+       }
+
+       ct helper rtsp {
+               type "rtsp" protocol tcp;
+       }
+
+
        #
        # Set definitions
        #
@@ -87,6 +140,11 @@ table inet fw4 {
                oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
        }
 
+       chain prerouting {
+               type filter hook prerouting priority filter; policy accept;
+               iifname "br-lan" jump helper_lan comment "!fw4: lan IPv4/IPv6 CT helper assignment"
+       }
+
        chain handle_reject {
                meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
                reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
@@ -110,6 +168,21 @@ table inet fw4 {
                jump accept_to_lan
        }
 
+       chain helper_lan {
+               meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
+               meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
+               meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
+               meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
+               meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
+               meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
+               meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
+               meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
+               meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
+               meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
+               meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
+               meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
+       }
+
        chain accept_from_lan {
                iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
        }
@@ -173,81 +246,17 @@ table inet fw4 {
 
 
        #
-       # Raw rules (notrack & helper)
+       # Raw rules (notrack)
        #
 
        chain raw_prerouting {
                type filter hook prerouting priority raw; policy accept;
-               iifname "br-lan" jump helper_lan comment "!fw4: lan IPv4/IPv6 CT helper assignment"
        }
 
        chain raw_output {
                type filter hook output priority raw; policy accept;
        }
 
-       ct helper amanda {
-               type "amanda" protocol udp;
-       }
-
-       ct helper ftp {
-               type "ftp" protocol tcp;
-       }
-
-       ct helper RAS {
-               type "RAS" protocol udp;
-       }
-
-       ct helper Q.931 {
-               type "Q.931" protocol tcp;
-       }
-
-       ct helper irc {
-               type "irc" protocol tcp;
-       }
-
-       ct helper netbios-ns {
-               type "netbios-ns" protocol udp;
-       }
-
-       ct helper pptp {
-               type "pptp" protocol tcp;
-       }
-
-       ct helper sane {
-               type "sane" protocol tcp;
-       }
-
-       ct helper sip {
-               type "sip" protocol udp;
-       }
-
-       ct helper snmp {
-               type "snmp" protocol udp;
-       }
-
-       ct helper tftp {
-               type "tftp" protocol udp;
-       }
-
-       ct helper rtsp {
-               type "rtsp" protocol tcp;
-       }
-
-       chain helper_lan {
-               meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto"
-               meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking"
-               meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking"
-               meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking"
-               meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking"
-               meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking"
-               meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking"
-               meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking"
-               meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking"
-               meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking"
-               meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking"
-               meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking"
-       }
-
 
        #
        # Mangle rules