speatzle/nfsense
1
0
Fork 0
mirror of https://github.com/speatzle/nfsense.git synced 2025-09-13 15:19:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

restructure project

Browse source
This commit is contained in:
Samuel Lorch 2023-03-26 18:50:18 +02:00
parent dd2db438f3
commit 2ca35d4461
46 changed files with 158 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

0
internal/nftables/template/addresses.tmpl Normal file
View file

2
internal/nftables/template/destination_nat_rules.tmpl Normal file
View file

@ -0,0 +1,2 @@
{{ range $rule := .Firewall.DestinationNATRules }}
{{ matcher $.Firewall.Services $.Firewall.Addresses $rule.Match }}{{ if $rule.Counter }} counter{{ end }}{{ if ne $rule.Comment "" }} comment "{{ $rule.Comment }}"{{ end }}{{ end }}

2
internal/nftables/template/forward_rules.tmpl Normal file
View file

@ -0,0 +1,2 @@
{{range $rule := .Firewall.ForwardRules}}
{{ matcher $.Firewall.Services $.Firewall.Addresses $rule.Match }}{{ if $rule.Counter }} counter{{ end }} {{ $rule.Verdict.String }}{{ if ne $rule.Comment "" }} comment "{{ $rule.Comment }}"{{ end }}{{ end }}

0
internal/nftables/template/inbound_rules.tmpl Normal file
View file

44
internal/nftables/template/nftables.tmpl Normal file
View file

@ -0,0 +1,44 @@
#!/usr/sbin/nft -f
flush ruleset
# Address object ipsets
{{template "addresses.tmpl" .}}
# nfsense nftables inet (ipv4 + ipv6) table
table inet nfsense_inet {
# Inbound Rules
chain inbound {
type filter hook input priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }
# allow loopback traffic
iifname lo accept
{{template "inbound_rules.tmpl" .}}
}
# Forward Rules
chain forward {
type filter hook forward priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }
{{template "forward_rules.tmpl" .}}
}
# Destination NAT Rules
chain prerouting {
type nat hook prerouting priority -100; policy accept;
{{template "destination_nat_rules.tmpl" .}}
}
# Source NAT Rules
chain postrouting {
type nat hook postrouting priority 100; policy accept;
{{template "source_nat_rules.tmpl" .}}
}
}

2
internal/nftables/template/source_nat_rules.tmpl Normal file
View file

@ -0,0 +1,2 @@
{{ range $rule := .Firewall.SourceNATRules }}
{{ matcher $.Firewall.Services $.Firewall.Addresses $rule.Match }}{{ if $rule.Counter }} counter{{ end }}{{ if ne $rule.Comment "" }} comment "{{ $rule.Comment }}"{{ end }}{{ end }}