abrown38andClaude Opus 5.5
47bae07d42
Fixes from an audit of the importer, each of which could change what an imported ruleset does: two base chains on one hook imported their rules twice (and hoisted the second's built-ins), now in priority order with the stricter policy; raw rules from a jumped-to chain lost the jump's condition, now put in front; a jump and a rule matching one field are combined only when one's addresses lie within the other's; a second match on a field replaced the first, and != on hop limit and TCP flags read as ==, now kept raw; a forward accept without ct status dnat no longer folds into the port forward, nor an interface-limited IPv6 accept into an open pinhole; raw rules' set references are renamed (NAME_v4/_v6) or written out, so nftables takes them; DNATs with matches a forward can't hold are left out with a note. Sets with flags timeout become dynamic sets; a DNAT of several ports one forward per port. Zone names: --zone IFACE=NAME (and on the Import page), VLAN defines, more suffixes, and a note on where each name came from. testdata/audit.nft covers the cases, checked with nft 1.1.3. make test and make e2e (246 checks) pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
54 lines
1.5 KiB
Plaintext
54 lines
1.5 KiB
Plaintext
#! /sbin/nft -f
|
|
# Cases the importer must not get wrong (importer_test.go TestImportAudit).
|
|
|
|
define wan_if = "wan"
|
|
define lan_if = "enp2s0"
|
|
define iot_if = "enp2s0.20"
|
|
define admins = { 10.9.0.0/24 }
|
|
|
|
table inet audit {
|
|
set blocklist {
|
|
type ipv4_addr
|
|
flags timeout
|
|
timeout 1h
|
|
}
|
|
set lans {
|
|
type ifname
|
|
elements = { "enp2s0", "enp3s0" }
|
|
}
|
|
|
|
chain early {
|
|
type filter hook input priority -10; policy accept;
|
|
ip saddr 192.0.2.66 drop comment "an early input chain"
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
ct state established,related accept
|
|
ip saddr @blocklist drop comment "dynamic"
|
|
iifname @lans accept comment "an interface set"
|
|
ip saddr 10.0.0.0/8 ip saddr != 10.0.10.0/24 tcp dport 22 drop comment "two source matches"
|
|
icmpv6 type nd-neighbor-solicit ip6 hoplimit != 255 drop comment "hop limit not 255"
|
|
iifname $iot_if udp dport 53 accept comment "DNS from the IoT VLAN"
|
|
ip saddr $admins jump admin
|
|
}
|
|
|
|
chain admin {
|
|
ip saddr 10.9.0.5 tcp dport 22 accept comment "within the jump"
|
|
ip saddr 10.8.0.1 tcp dport 23 accept comment "outside the jump"
|
|
meta mark 0x00000001 accept comment "raw under the jump"
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop;
|
|
ct state established,related accept
|
|
ip daddr 10.0.10.37 tcp dport 443 accept comment "not only forwarded"
|
|
iifname $lan_if oifname $wan_if accept
|
|
}
|
|
|
|
chain prerouting {
|
|
type nat hook prerouting priority dstnat; policy accept;
|
|
ip daddr 203.0.113.1 tcp dport { 80, 443 } dnat ip to 10.0.10.37 comment "web"
|
|
}
|
|
}
|