1 Test the prefix translation of nat sections with target npt. 2 3 -- Testcase -- 4 {% 5 include("./root/usr/share/firewall4/main.uc", { 6 getenv: function(varname) { 7 switch (varname) { 8 case 'ACTION': 9 return 'print'; 10 } 11 } 12 }) 13 %} 14 -- End -- 15 16 -- File fs/open~_sys_class_net_pppoe-wan_flags.txt -- 17 0x1191 18 -- End -- 19 20 -- File uci/helpers.json -- 21 {} 22 -- End -- 23 24 -- File uci/firewall.json -- 25 { 26 "zone": [ 27 { 28 "name": "wan", 29 "network": [ "wan", "wan6" ] 30 }, 31 { 32 "name": "lan", 33 "network": "lan", 34 "auto_helper": 0 35 } 36 ], 37 "nat": [ 38 { 39 ".description": "Ensure a zone gives a prefix SNAT and the reverse prefix DNAT in the chains of the zone", 40 "name": "NPT test #1", 41 "src": "wan", 42 "target": "npt", 43 "src_ip": "fd00:21::/64", 44 "snat_ip": "2001:db8:200::/64" 45 }, 46 { 47 ".description": "Ensure a device gives oifname and iifname matches, and host bits are masked", 48 "name": "NPT test #2", 49 "device": "eth1", 50 "target": "npt", 51 "src_ip": "fd00:22::1/48", 52 "snat_ip": "2001:db8:300::1/48", 53 "counter": "0" 54 }, 55 { 56 ".description": "Ensure IPv4 prefixes give a netmap", 57 "name": "NPT test #3", 58 "device": "eth1", 59 "target": "npt", 60 "src_ip": "10.0.0.0/24", 61 "snat_ip": "192.0.2.0/24" 62 }, 63 { 64 ".description": "Ensure prefixes of different lengths are refused", 65 "name": "NPT test #4", 66 "device": "eth1", 67 "target": "npt", 68 "src_ip": "fd00:24::/64", 69 "snat_ip": "2001:db8:400::/56" 70 }, 71 { 72 ".description": "Ensure prefixes of different families are refused", 73 "name": "NPT test #5", 74 "device": "eth1", 75 "target": "npt", 76 "src_ip": "fd00:25::/64", 77 "snat_ip": "192.0.2.0/24" 78 }, 79 { 80 ".description": "Ensure a section without zone or device is refused", 81 "name": "NPT test #6", 82 "target": "npt", 83 "src_ip": "fd00:26::/64", 84 "snat_ip": "2001:db8:600::/64" 85 }, 86 { 87 ".description": "Ensure ports are refused", 88 "name": "NPT test #7", 89 "src": "wan", 90 "target": "npt", 91 "proto": "tcp", 92 "dest_port": "80", 93 "src_ip": "fd00:27::/64", 94 "snat_ip": "2001:db8:700::/64" 95 }, 96 { 97 ".description": "Ensure a section without prefixes is refused", 98 "name": "NPT test #8", 99 "src": "wan", 100 "target": "npt" 101 } 102 ] 103 } 104 -- End -- 105 106 -- Expect stderr -- 107 [!] Section @nat[3] (NPT test #4) needs one prefix of the same family and length in 'src_ip' and 'snat_ip' for target npt, ignoring section 108 [!] Section @nat[4] (NPT test #5) needs one prefix of the same family and length in 'src_ip' and 'snat_ip' for target npt, ignoring section 109 [!] Section @nat[5] (NPT test #6) needs either 'src' or 'device' for target npt, ignoring section 110 [!] Section @nat[6] (NPT test #7) must not use 'src_port', 'dest_port' or 'dest_ip' for target npt, ignoring section 111 [!] Section @nat[7] (NPT test #8) needs one prefix of the same family and length in 'src_ip' and 'snat_ip' for target npt, ignoring section 112 -- End -- 113 114 -- Expect stdout -- 115 table inet fw4 116 flush table inet fw4 117 118 table inet fw4 { 119 # 120 # Defines 121 # 122 123 define wan_devices = { "pppoe-wan" } 124 define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 } 125 126 define lan_devices = { "br-lan" } 127 define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 } 128 129 130 # 131 # User includes 132 # 133 134 include "/etc/nftables.d/*.nft" 135 136 137 # 138 # Filter rules 139 # 140 141 chain input { 142 type filter hook input priority filter; policy drop; 143 144 iif "lo" accept comment "!fw4: Accept traffic from loopback" 145 146 ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows" 147 iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic" 148 iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic" 149 } 150 151 chain forward { 152 type filter hook forward priority filter; policy drop; 153 154 ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" 155 iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic" 156 iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" 157 } 158 159 chain output { 160 type filter hook output priority filter; policy drop; 161 162 oif "lo" accept comment "!fw4: Accept traffic towards loopback" 163 164 ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows" 165 oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic" 166 oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic" 167 } 168 169 chain prerouting { 170 type filter hook prerouting priority filter; policy accept; 171 } 172 173 chain handle_reject { 174 meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic" 175 reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic" 176 } 177 178 chain input_wan { 179 jump drop_from_wan 180 } 181 182 chain output_wan { 183 jump drop_to_wan 184 } 185 186 chain forward_wan { 187 jump drop_to_wan 188 } 189 190 chain drop_from_wan { 191 iifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 192 } 193 194 chain drop_to_wan { 195 oifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic" 196 } 197 198 chain input_lan { 199 jump drop_from_lan 200 } 201 202 chain output_lan { 203 jump drop_to_lan 204 } 205 206 chain forward_lan { 207 jump drop_to_lan 208 } 209 210 chain drop_from_lan { 211 iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 212 } 213 214 chain drop_to_lan { 215 oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic" 216 } 217 218 219 # 220 # NAT rules 221 # 222 223 chain dstnat { 224 type nat hook prerouting priority dstnat; policy accept; 225 iifname "eth1" ip6 daddr 2001:db8:300::/48 dnat ip6 prefix to ip6 daddr map { 2001:db8:300::/48 : fd00:22::/48 } comment "!fw4: NPT test #2" 226 iifname "eth1" ip daddr 192.0.2.0/24 counter dnat ip prefix to ip daddr map { 192.0.2.0/24 : 10.0.0.0/24 } comment "!fw4: NPT test #3" 227 iifname "pppoe-wan" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic" 228 } 229 230 chain srcnat { 231 type nat hook postrouting priority srcnat; policy accept; 232 oifname "eth1" ip6 saddr fd00:22::/48 snat ip6 prefix to ip6 saddr map { fd00:22::/48 : 2001:db8:300::/48 } comment "!fw4: NPT test #2" 233 oifname "eth1" ip saddr 10.0.0.0/24 counter snat ip prefix to ip saddr map { 10.0.0.0/24 : 192.0.2.0/24 } comment "!fw4: NPT test #3" 234 oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic" 235 } 236 237 chain dstnat_wan { 238 ip6 daddr 2001:db8:200::/64 counter dnat ip6 prefix to ip6 daddr map { 2001:db8:200::/64 : fd00:21::/64 } comment "!fw4: NPT test #1" 239 } 240 241 chain srcnat_wan { 242 ip6 saddr fd00:21::/64 counter snat ip6 prefix to ip6 saddr map { fd00:21::/64 : 2001:db8:200::/64 } comment "!fw4: NPT test #1" 243 } 244 245 246 # 247 # Raw rules (notrack) 248 # 249 250 chain raw_prerouting { 251 type filter hook prerouting priority raw; policy accept; 252 } 253 254 chain raw_output { 255 type filter hook output priority raw; policy accept; 256 } 257 258 259 # 260 # Mangle rules 261 # 262 263 chain mangle_prerouting { 264 type filter hook prerouting priority mangle; policy accept; 265 } 266 267 chain mangle_postrouting { 268 type filter hook postrouting priority mangle; policy accept; 269 } 270 271 chain mangle_input { 272 type filter hook input priority mangle; policy accept; 273 } 274 275 chain mangle_output { 276 type route hook output priority mangle; policy accept; 277 } 278 279 chain mangle_forward { 280 type filter hook forward priority mangle; policy accept; 281 } 282 } 283 -- End --
This page was automatically generated by LXR 0.3.1. • OpenWrt