1 Testing the ruleset rendered from the default firewall configuration. 2 3 -- Testcase -- 4 {% 5 include("./root/usr/share/firewall4/main.uc", { 6 TRACE_CALLS: "stderr", 7 8 getenv: function(varname) { 9 switch (varname) { 10 case 'ACTION': 11 return 'print'; 12 } 13 } 14 }) 15 %} 16 -- End -- 17 18 -- Expect stdout -- 19 table inet fw4 20 flush table inet fw4 21 22 table inet fw4 { 23 # 24 # Flowtable 25 # 26 27 flowtable ft { 28 hook ingress priority 0; 29 devices = { "eth0", "eth1" }; 30 counter; 31 flags offload; 32 } 33 34 35 # 36 # CT helper definitions 37 # 38 39 ct helper amanda { 40 type "amanda" protocol udp; 41 } 42 43 ct helper ftp { 44 type "ftp" protocol tcp; 45 } 46 47 ct helper RAS { 48 type "RAS" protocol udp; 49 } 50 51 ct helper Q.931 { 52 type "Q.931" protocol tcp; 53 } 54 55 ct helper irc { 56 type "irc" protocol tcp; 57 } 58 59 ct helper netbios-ns { 60 type "netbios-ns" protocol udp; 61 } 62 63 ct helper pptp { 64 type "pptp" protocol tcp; 65 } 66 67 ct helper sane { 68 type "sane" protocol tcp; 69 } 70 71 ct helper sip { 72 type "sip" protocol udp; 73 } 74 75 ct helper snmp { 76 type "snmp" protocol udp; 77 } 78 79 ct helper tftp { 80 type "tftp" protocol udp; 81 } 82 83 ct helper rtsp { 84 type "rtsp" protocol tcp; 85 } 86 87 88 # 89 # Defines 90 # 91 92 define lan_devices = { "br-lan" } 93 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 } 94 95 define wan_devices = { "pppoe-wan" } 96 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 } 97 98 99 # 100 # User includes 101 # 102 103 include "/etc/nftables.d/*.nft" 104 105 106 # 107 # Filter rules 108 # 109 110 chain input { 111 type filter hook input priority filter; policy drop; 112 113 iif "lo" accept comment "!fw4: Accept traffic from loopback" 114 115 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 116 tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets" 117 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 118 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 119 jump handle_reject 120 } 121 122 chain forward { 123 type filter hook forward priority filter; policy drop; 124 125 meta l4proto { tcp, udp } flow offload @ft; 126 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 127 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 128 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 129 jump handle_reject 130 } 131 132 chain output { 133 type filter hook output priority filter; policy accept; 134 135 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 136 137 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 138 meta l4proto tcp counter comment "!fw4: Test-Deprecated-Rule-Option" 139 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 140 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 141 } 142 143 chain prerouting { 144 type filter hook prerouting priority filter; policy accept; 145 iifname "br-lan" jump helper_lan comment "!fw4: Handle lan IPv4/IPv6 helper assignment" 146 } 147 148 chain handle_reject { 149 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 150 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 151 } 152 153 chain syn_flood { 154 limit rate 25/second burst 50 packets return comment "!fw4: Accept SYN packets below rate-limit" 155 drop comment "!fw4: Drop excess packets" 156 } 157 158 chain input_lan { 159 jump accept_from_lan 160 } 161 162 chain output_lan { 163 jump accept_to_lan 164 } 165 166 chain forward_lan { 167 jump accept_to_wan comment "!fw4: Accept lan to wan forwarding" 168 jump accept_to_lan 169 } 170 171 chain helper_lan { 172 meta l4proto udp udp dport 10080 ct helper set "amanda" comment "!fw4: Amanda backup and archiving proto" 173 meta l4proto tcp tcp dport 21 ct helper set "ftp" comment "!fw4: FTP passive connection tracking" 174 meta l4proto udp udp dport 1719 ct helper set "RAS" comment "!fw4: RAS proto tracking" 175 meta l4proto tcp tcp dport 1720 ct helper set "Q.931" comment "!fw4: Q.931 proto tracking" 176 meta nfproto ipv4 meta l4proto tcp tcp dport 6667 ct helper set "irc" comment "!fw4: IRC DCC connection tracking" 177 meta nfproto ipv4 meta l4proto udp udp dport 137 ct helper set "netbios-ns" comment "!fw4: NetBIOS name service broadcast tracking" 178 meta nfproto ipv4 meta l4proto tcp tcp dport 1723 ct helper set "pptp" comment "!fw4: PPTP VPN connection tracking" 179 meta l4proto tcp tcp dport 6566 ct helper set "sane" comment "!fw4: SANE scanner connection tracking" 180 meta l4proto udp udp dport 5060 ct helper set "sip" comment "!fw4: SIP VoIP connection tracking" 181 meta nfproto ipv4 meta l4proto udp udp dport 161 ct helper set "snmp" comment "!fw4: SNMP monitoring connection tracking" 182 meta l4proto udp udp dport 69 ct helper set "tftp" comment "!fw4: TFTP connection tracking" 183 meta nfproto ipv4 meta l4proto tcp tcp dport 554 ct helper set "rtsp" comment "!fw4: RTSP connection tracking" 184 } 185 186 chain accept_from_lan { 187 iifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 188 } 189 190 chain accept_to_lan { 191 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 192 } 193 194 chain input_wan { 195 meta nfproto ipv4 udp dport 68 counter accept comment "!fw4: Allow-DHCP-Renew" 196 meta nfproto ipv4 icmp type 8 counter accept comment "!fw4: Allow-Ping" 197 meta nfproto ipv4 meta l4proto igmp counter accept comment "!fw4: Allow-IGMP" 198 ip6 saddr fc00::/6 ip6 daddr fc00::/6 udp dport 546 counter accept comment "!fw4: Allow-DHCPv6" 199 ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { 130 . 0, 131 . 0, 132 . 0, 143 . 0 } counter accept comment "!fw4: Allow-MLD" 200 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3, 133, 134 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input" 201 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1, 135 . 0, 136 . 0 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Input" 202 jump reject_from_wan 203 } 204 205 chain output_wan { 206 jump accept_to_wan 207 } 208 209 chain forward_wan { 210 meta nfproto ipv6 icmpv6 type { 128, 129, 1, 3 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward" 211 meta nfproto ipv6 icmpv6 type . icmpv6 code { 2 . 0, 4 . 0, 4 . 1 } limit rate 1000/second counter accept comment "!fw4: Allow-ICMPv6-Forward" 212 meta l4proto esp counter jump accept_to_lan comment "!fw4: Allow-IPSec-ESP" 213 udp dport 500 counter jump accept_to_lan comment "!fw4: Allow-ISAKMP" 214 jump reject_to_wan 215 } 216 217 chain accept_to_wan { 218 meta nfproto ipv4 oifname "pppoe-wan" ct state invalid counter drop comment "!fw4: Prevent NAT leakage" 219 oifname "pppoe-wan" counter accept comment "!fw4: accept wan IPv4/IPv6 traffic" 220 } 221 222 chain reject_from_wan { 223 iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 224 } 225 226 chain reject_to_wan { 227 oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic" 228 } 229 230 231 # 232 # NAT rules 233 # 234 235 chain dstnat { 236 type nat hook prerouting priority dstnat; policy accept; 237 } 238 239 chain srcnat { 240 type nat hook postrouting priority srcnat; policy accept; 241 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 242 } 243 244 chain srcnat_wan { 245 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 246 } 247 248 249 # 250 # Raw rules (notrack) 251 # 252 253 chain raw_prerouting { 254 type filter hook prerouting priority raw; policy accept; 255 } 256 257 chain raw_output { 258 type filter hook output priority raw; policy accept; 259 } 260 261 262 # 263 # Mangle rules 264 # 265 266 chain mangle_prerouting { 267 type filter hook prerouting priority mangle; policy accept; 268 } 269 270 chain mangle_postrouting { 271 type filter hook postrouting priority mangle; policy accept; 272 oifname "pppoe-wan" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 egress MTU fixing" 273 } 274 275 chain mangle_input { 276 type filter hook input priority mangle; policy accept; 277 } 278 279 chain mangle_output { 280 type route hook output priority mangle; policy accept; 281 } 282 283 chain mangle_forward { 284 type filter hook forward priority mangle; policy accept; 285 iifname "pppoe-wan" tcp flags syn / syn,fin,rst tcp option maxseg size set rt mtu comment "!fw4: Zone wan IPv4/IPv6 ingress MTU fixing" 286 } 287 } 288 -- End -- 289 290 -- Expect stderr -- 291 [call] ctx.call object <network.interface> method <dump> args <null> 292 [call] ctx.call object <service> method <get_data> args <{ "type": "firewall" }> 293 [call] fs.open path </proc/version> mode <r> 294 [call] fs.stat path </sys/module/nf_conntrack_amanda> 295 [call] fs.stat path </sys/module/nf_conntrack_ftp> 296 [call] fs.stat path </sys/module/nf_conntrack_h323> 297 [call] fs.stat path </sys/module/nf_conntrack_h323> 298 [call] fs.stat path </sys/module/nf_conntrack_irc> 299 [call] fs.stat path </sys/module/nf_conntrack_netbios_ns> 300 [call] fs.stat path </sys/module/nf_conntrack_pptp> 301 [call] fs.stat path </sys/module/nf_conntrack_sane> 302 [call] fs.stat path </sys/module/nf_conntrack_sip> 303 [call] fs.stat path </sys/module/nf_conntrack_snmp> 304 [call] fs.stat path </sys/module/nf_conntrack_tftp> 305 [call] fs.stat path </sys/module/nf_conntrack_rtsp> 306 [!] Section @defaults[0] specifies unknown option 'unknown_defaults_option' 307 [!] Section @rule[9] (Test-Deprecated-Rule-Option) option '_name' is deprecated by fw4 308 [!] Section @rule[9] (Test-Deprecated-Rule-Option) specifies unknown option 'unknown_rule_option' 309 [call] fs.glob pattern </usr/share/nftables.d/ruleset-pre/*.nft> 310 [call] fs.glob pattern </usr/share/nftables.d/ruleset-post/*.nft> 311 [call] fs.glob pattern </usr/share/nftables.d/table-pre/*.nft> 312 [call] fs.glob pattern </usr/share/nftables.d/table-post/*.nft> 313 [call] fs.lsdir path </usr/share/nftables.d/chain-pre> 314 [call] fs.lsdir path </usr/share/nftables.d/chain-post> 315 [call] ctx.call object <network.device> method <status> args <null> 316 [call] fs.opendir path </sys/class/net/br-lan> 317 [call] fs.opendir path </sys/class/net/eth0> 318 [call] fs.opendir path </sys/class/net/eth1> 319 [call] system command </usr/sbin/nft -c ' 320 add table inet fw4-hw-offload-test; 321 add flowtable inet fw4-hw-offload-test ft { 322 hook ingress priority 0; 323 devices = { "eth0", "eth1" }; 324 flags offload; 325 } 326 ' 2>/dev/null> timeout <null> 327 [call] fs.popen cmdline </usr/sbin/nft --terse --json list flowtables inet> mode <r> 328 [call] fs.readfile path </sys/class/net/br-lan/flags> limit <null> 329 [call] fs.readfile path </sys/class/net/br-lan/flags> limit <null> 330 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt