Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: uplinks drop new forwarded connections that were not DNATed, replaces no_hairpin_ifaces

Browse Source
This commit is contained in:
Ruakij
2026-11-06 08:48:29 +00:00
parent 79943e0389
commit 483f3890e5
2 changed files with 11 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/templates/host.nft.j2
+6 -5
View File
@@ -441,14 +441,10 @@ table inet host {
ip6 saddr @geo_v6 accept
{% endif %}
}
{% if forward_guard or blocklists or firewall.scanners or rl_forward or firewall.block_smtp_out or firewall.no_hairpin_ifaces %}
{% if forward_guard or blocklists or firewall.scanners or rl_forward or firewall.block_smtp_out or firewall.uplinks %}
chain forward {
type filter hook forward priority filter; policy accept;
{% for name, iface in firewall.no_hairpin_ifaces.items() %}
iifname "{{ iface }}" oifname "{{ iface }}" counter drop comment "{{ name }}: no forwarding back out of the uplink"
{% endfor %}
{% if rl_forward %}
# Docker-published ports and port forwards arrive here after DNAT; pod and guest egress is not DNATed.
@@ -496,6 +492,11 @@ table inet host {
{{ match }} jump drop_log
{% endfor %}
{% endfor %}
{% for name, iface in firewall.uplinks.items() if iface is not none %}
# {{ name }}: from outside only what was DNATed here or admitted by a forward_guard zone above.
iifname "{{ iface }}" ct state new ct status & dnat == 0 counter drop
{% endfor %}
{% if firewall.block_smtp_out %}
# Pod, container and guest egress to tcp/25 is rejected like the host's own (chain output). Connections DNATed to