host_firewall: sources zone accepts tcp ports from listed addresses alone

2026-10-28 13:59:37 +00:00
parent c1c71194c6
commit 0abc9fb1c3
2 changed files with 10 additions and 0 deletions
@@ -367,6 +367,14 @@ table inet host {
 {% if list(firewall.public.udp) %}
 		udp dport { {{ list(firewall.public.udp) }} } accept
 {% endif %}
+{% for src in firewall.sources | default({}, true) | dict2items | rejectattr('value', 'none') | map(attribute='value') %}
+{% if list(src.tcp) and list(src.v4) %}
+		ip saddr { {{ list(src.v4) }} } tcp dport { {{ list(src.tcp) }} } accept
+{% endif %}
+{% if list(src.tcp) and list(src.v6) %}
+		ip6 saddr { {{ list(src.v6) }} } tcp dport { {{ list(src.tcp) }} } accept
+{% endif %}
+{% endfor %}
 {% if list(firewall.geo.tcp) %}
 		tcp dport { {{ list(firewall.geo.tcp) }} } jump geo
 {% endif %}