1 Test various address selection rules in redirect rules. 2 3 -- Testcase -- 4 {% 5 include("./root/usr/share/firewall4/main.uc", { 6 getenv: function(varname) { 7 switch (varname) { 8 case 'ACTION': 9 return 'print'; 10 } 11 } 12 }) 13 %} 14 -- End -- 15 16 -- File uci/helpers.json -- 17 {} 18 -- End -- 19 20 -- File uci/firewall.json -- 21 { 22 "zone": [ 23 { 24 "name": "wan", 25 "network": [ "wan", "wan6" ], 26 "masq": 1, 27 "masq6": 1 28 }, 29 { 30 "name": "lan", 31 "network": "lan", 32 "auto_helper": 0 33 }, 34 { 35 "name": "noaddr", 36 "network": [ "noaddr" ], 37 "masq": 1, 38 "masq6": 1 39 } 40 ], 41 "ipset": [ 42 { 43 "name": "dest-a", 44 "match": "dest_ip", 45 "entry": [ "198.51.100.10", "203.0.113.10" ] 46 }, 47 { 48 "name": "dest-b", 49 "match": "dest_ip", 50 "entry": [ "198.51.100.20", "203.0.113.20" ] 51 } 52 ], 53 "redirect": [ 54 { 55 ".description": "Ensure unspecified family with no src, dest or rewrite address is treated as IPv4 only", 56 "name": "Redirect test #1", 57 "src": "lan", 58 "dest": "wan", 59 "proto": "udp", 60 "src_dport": "53", 61 "dest_port": "53", 62 "target": "dnat" 63 }, 64 { 65 ".description": "Ensure that explicit family any with no src, dest or rewrite address is treated as IPv4/IPv6", 66 "name": "Redirect test #2", 67 "family": "any", 68 "src": "lan", 69 "dest": "wan", 70 "proto": "udp", 71 "src_dport": "53", 72 "dest_port": "53", 73 "target": "dnat" 74 }, 75 { 76 ".description": "Ensure that a DNAT without explicit dest zone infers the zone from the rewrite address", 77 "name": "Redirect test #3", 78 "src": "wan", 79 "proto": "tcp", 80 "src_dport": "22", 81 "dest_ip": "192.168.26.100" 82 }, 83 { 84 ".description": "Ensure that external reflection source uses the src zone addr as reflection source IP", 85 "name": "Redirect test #4", 86 "src": "wan", 87 "proto": "tcp", 88 "src_dport": "23", 89 "dest_ip": "192.168.26.100", 90 "dest_port": "23", 91 "reflection_src": "external" 92 }, 93 { 94 ".description": "Ensure that reflection is disabled if external address cannot be determined", 95 "name": "Redirect test #5", 96 "src": "noaddr", 97 "dest": "lan", 98 "proto": "tcp", 99 "src_dport": "24", 100 "dest_ip": "192.168.26.100" 101 }, 102 { 103 ".description": "Ensure that the rewrite IPv6 address is using bracket notation when a port is specified", 104 "name": "Redirect test #6", 105 "family": "ipv6", 106 "src": "wan", 107 "dest": "lan", 108 "proto": "tcp", 109 "src_dport": "25", 110 "dest_ip": "2001:db8:1000:1::1234", 111 "dest_port": "25", 112 "target": "dnat" 113 }, 114 { 115 ".description": "Ensure that family restricted redirect rules work properly", 116 "name": "Redirect test #7", 117 "family": "ipv4", 118 "src": "wan", 119 "dest": "lan", 120 "proto": "tcp", 121 "src_dport": "26", 122 "dest_port": "26", 123 "target": "dnat" 124 }, 125 { 126 ".description": "Ensure that family restricted redirect rules work properly", 127 "name": "Redirect test #8", 128 "family": "ipv6", 129 "src": "wan", 130 "dest": "lan", 131 "proto": "tcp", 132 "src_dport": "27", 133 "target": "dnat" 134 }, 135 { 136 ".description": "Ensure inverse address match works properly", 137 "name": "Redirect test #9", 138 "src": "lan", 139 "dest": "wan", 140 "proto": "tcp udp", 141 "src_dport": "53", 142 "dest_ip": "192.168.1.53", 143 "src_ip": "!192.168.1.53", 144 "target": "dnat" 145 }, 146 { 147 ".description": "Ensure reflection uses the destination ipset instead of the WAN address", 148 "name": "Redirect test #9", 149 "src": "wan", 150 "dest": "lan", 151 "proto": "tcpudp", 152 "src_dport": "443", 153 "dest_ip": "192.168.26.100", 154 "dest_port": "8443", 155 "ipset": "dest-a", 156 "reflection": 1, 157 "target": "dnat" 158 }, 159 { 160 ".description": "Ensure reflection keeps different destination ipsets for forwards sharing a port", 161 "name": "Redirect test #10", 162 "src": "wan", 163 "dest": "lan", 164 "proto": "tcpudp", 165 "src_dport": "443", 166 "dest_ip": "192.168.26.200", 167 "dest_port": "9443", 168 "ipset": "dest-b", 169 "reflection": 1, 170 "target": "dnat" 171 } 172 ], 173 "nat": [ 174 { 175 ".description": "Ensure that masq to specific port or port range rules work properly", 176 "name": "masq snat test #1", 177 "family": "ipv4", 178 "src": "wan", 179 "proto": "tcp udp", 180 "snat_port": "61000-62900", 181 "target": "MASQUERADE" 182 } 183 ] 184 } 185 -- End -- 186 187 -- Expect stderr -- 188 [!] Section @redirect[2] (Redirect test #3) does not specify a destination, assuming 'lan' 189 [!] Section @redirect[3] (Redirect test #4) does not specify a destination, assuming 'lan' 190 [!] Section @redirect[4] (Redirect test #5) external address range cannot be determined, disabling reflection 191 -- End -- 192 193 -- Expect stdout -- 194 table inet fw4 195 flush table inet fw4 196 197 table inet fw4 { 198 # 199 # Set definitions 200 # 201 202 set dest-a { 203 type ipv4_addr 204 elements = { 205 198.51.100.10, 206 203.0.113.10, 207 } 208 } 209 210 set dest-b { 211 type ipv4_addr 212 elements = { 213 198.51.100.20, 214 203.0.113.20, 215 } 216 } 217 218 219 # 220 # Defines 221 # 222 223 define wan_devices = { "pppoe-wan" } 224 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 } 225 226 define lan_devices = { "br-lan" } 227 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 } 228 229 define noaddr_devices = { "wwan0" } 230 define noaddr_subnets = { } 231 232 233 # 234 # User includes 235 # 236 237 include "/etc/nftables.d/*.nft" 238 239 240 # 241 # Filter rules 242 # 243 244 chain input { 245 type filter hook input priority filter; policy drop; 246 247 iif "lo" accept comment "!fw4: Accept traffic from loopback" 248 249 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 250 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 251 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 252 iifname "wwan0" jump input_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 input traffic" 253 } 254 255 chain forward { 256 type filter hook forward priority filter; policy drop; 257 258 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 259 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 260 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 261 iifname "wwan0" jump forward_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 forward traffic" 262 } 263 264 chain output { 265 type filter hook output priority filter; policy drop; 266 267 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 268 269 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 270 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 271 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 272 oifname "wwan0" jump output_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 output traffic" 273 } 274 275 chain prerouting { 276 type filter hook prerouting priority filter; policy accept; 277 } 278 279 chain handle_reject { 280 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 281 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 282 } 283 284 chain input_wan { 285 ct status dnat accept comment "!fw4: Accept port redirections" 286 jump drop_from_wan 287 } 288 289 chain output_wan { 290 jump drop_to_wan 291 } 292 293 chain forward_wan { 294 ct status dnat accept comment "!fw4: Accept port forwards" 295 jump drop_to_wan 296 } 297 298 chain drop_from_wan { 299 iifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 300 } 301 302 chain drop_to_wan { 303 oifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 304 } 305 306 chain input_lan { 307 ct status dnat accept comment "!fw4: Accept port redirections" 308 jump drop_from_lan 309 } 310 311 chain output_lan { 312 jump drop_to_lan 313 } 314 315 chain forward_lan { 316 ct status dnat accept comment "!fw4: Accept port forwards" 317 jump drop_to_lan 318 } 319 320 chain accept_to_lan { 321 oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic" 322 } 323 324 chain drop_from_lan { 325 iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 326 } 327 328 chain drop_to_lan { 329 oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 330 } 331 332 chain input_noaddr { 333 ct status dnat accept comment "!fw4: Accept port redirections" 334 jump drop_from_noaddr 335 } 336 337 chain output_noaddr { 338 jump drop_to_noaddr 339 } 340 341 chain forward_noaddr { 342 ct status dnat accept comment "!fw4: Accept port forwards" 343 jump drop_to_noaddr 344 } 345 346 chain drop_from_noaddr { 347 iifname "wwan0" counter drop comment "!fw4: drop noaddr IPv4/IPv6 traffic" 348 } 349 350 chain drop_to_noaddr { 351 oifname "wwan0" counter drop comment "!fw4: drop noaddr IPv4/IPv6 traffic" 352 } 353 354 355 # 356 # NAT rules 357 # 358 359 chain dstnat { 360 type nat hook prerouting priority dstnat; policy accept; 361 iifname "pppoe-wan" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic" 362 iifname "br-lan" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic" 363 iifname "wwan0" jump dstnat_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 dstnat traffic" 364 } 365 366 chain srcnat { 367 type nat hook postrouting priority srcnat; policy accept; 368 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 369 oifname "br-lan" jump srcnat_lan comment "!fw4: Handle lan IPv4/IPv6 srcnat traffic" 370 oifname "wwan0" jump srcnat_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 srcnat traffic" 371 } 372 373 chain dstnat_wan { 374 meta nfproto ipv4 tcp dport 22 counter dnat 192.168.26.100 comment "!fw4: Redirect test #3" 375 meta nfproto ipv4 tcp dport 23 counter dnat 192.168.26.100:23 comment "!fw4: Redirect test #4" 376 meta nfproto ipv6 tcp dport 25 counter dnat [2001:db8:1000:1::1234]:25 comment "!fw4: Redirect test #6" 377 meta nfproto ipv4 tcp dport 26 counter redirect to 26 comment "!fw4: Redirect test #7" 378 meta nfproto ipv6 tcp dport 27 counter redirect comment "!fw4: Redirect test #8" 379 meta nfproto ipv4 tcp dport 443 ip daddr @dest-a counter dnat 192.168.26.100:8443 comment "!fw4: Redirect test #9" 380 meta nfproto ipv4 udp dport 443 ip daddr @dest-a counter dnat 192.168.26.100:8443 comment "!fw4: Redirect test #9" 381 meta nfproto ipv4 tcp dport 443 ip daddr @dest-b counter dnat 192.168.26.200:9443 comment "!fw4: Redirect test #10" 382 meta nfproto ipv4 udp dport 443 ip daddr @dest-b counter dnat 192.168.26.200:9443 comment "!fw4: Redirect test #10" 383 } 384 385 chain srcnat_wan { 386 meta nfproto ipv4 meta l4proto tcp counter masquerade to :61000-62900 comment "!fw4: masq snat test #1" 387 meta nfproto ipv4 meta l4proto udp counter masquerade to :61000-62900 comment "!fw4: masq snat test #1" 388 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic" 389 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 wan traffic" 390 } 391 392 chain dstnat_lan { 393 meta nfproto ipv4 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #1" 394 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #2" 395 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 22 dnat 192.168.26.100 comment "!fw4: Redirect test #3 (reflection)" 396 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 23 dnat 192.168.26.100:23 comment "!fw4: Redirect test #4 (reflection)" 397 ip6 saddr { 2001:db8:1000::/60, fd63:e2f:f706::/60 } ip6 daddr 2001:db8:54:321::2 tcp dport 25 dnat [2001:db8:1000:1::1234]:25 comment "!fw4: Redirect test #6 (reflection)" 398 ip saddr != 192.168.1.53 tcp dport 53 counter dnat 192.168.1.53 comment "!fw4: Redirect test #9" 399 ip saddr != 192.168.1.53 udp dport 53 counter dnat 192.168.1.53 comment "!fw4: Redirect test #9" 400 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } tcp dport 443 ip daddr @dest-a dnat 192.168.26.100:8443 comment "!fw4: Redirect test #9 (reflection)" 401 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } udp dport 443 ip daddr @dest-a dnat 192.168.26.100:8443 comment "!fw4: Redirect test #9 (reflection)" 402 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } tcp dport 443 ip daddr @dest-b dnat 192.168.26.200:9443 comment "!fw4: Redirect test #10 (reflection)" 403 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } udp dport 443 ip daddr @dest-b dnat 192.168.26.200:9443 comment "!fw4: Redirect test #10 (reflection)" 404 } 405 406 chain srcnat_lan { 407 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 22 snat 192.168.26.1 comment "!fw4: Redirect test #3 (reflection)" 408 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 23 snat 10.11.12.194 comment "!fw4: Redirect test #4 (reflection)" 409 ip6 saddr { 2001:db8:1000::/60, fd63:e2f:f706::/60 } ip6 daddr 2001:db8:1000:1::1234 tcp dport 25 snat 2001:db8:1000:1::1 comment "!fw4: Redirect test #6 (reflection)" 410 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 8443 snat 192.168.26.1 comment "!fw4: Redirect test #9 (reflection)" 411 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 udp dport 8443 snat 192.168.26.1 comment "!fw4: Redirect test #9 (reflection)" 412 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.200 tcp dport 9443 snat 192.168.26.1 comment "!fw4: Redirect test #10 (reflection)" 413 ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.200 udp dport 9443 snat 192.168.26.1 comment "!fw4: Redirect test #10 (reflection)" 414 } 415 416 chain dstnat_noaddr { 417 meta nfproto ipv4 tcp dport 24 counter dnat 192.168.26.100 comment "!fw4: Redirect test #5" 418 } 419 420 chain srcnat_noaddr { 421 meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 noaddr traffic" 422 meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 noaddr traffic" 423 } 424 425 426 # 427 # Raw rules (notrack) 428 # 429 430 chain raw_prerouting { 431 type filter hook prerouting priority raw; policy accept; 432 } 433 434 chain raw_output { 435 type filter hook output priority raw; policy accept; 436 } 437 438 439 # 440 # Mangle rules 441 # 442 443 chain mangle_prerouting { 444 type filter hook prerouting priority mangle; policy accept; 445 } 446 447 chain mangle_postrouting { 448 type filter hook postrouting priority mangle; policy accept; 449 } 450 451 chain mangle_input { 452 type filter hook input priority mangle; policy accept; 453 } 454 455 chain mangle_output { 456 type route hook output priority mangle; policy accept; 457 } 458 459 chain mangle_forward { 460 type filter hook forward priority mangle; policy accept; 461 } 462 } 463 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt