From 74a0af2d320a54e6cfd9b62ce7546ba81e463a50 Mon Sep 17 00:00:00 2001 From: Ruakij Date: Tue, 3 Nov 2026 16:59:44 +0000 Subject: [PATCH] host_firewall: reject forwarded tcp/25 egress like the host output rule --- host_firewall/templates/host.nft.j2 | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/host_firewall/templates/host.nft.j2 b/host_firewall/templates/host.nft.j2 index 60bd374..c3f0f43 100644 --- a/host_firewall/templates/host.nft.j2 +++ b/host_firewall/templates/host.nft.j2 @@ -424,7 +424,7 @@ table inet host { ip6 saddr @geo_v6 accept {% endif %} } -{% if forward_guard or blocklists or firewall.scanners or firewall.greensnow or rl_forward %} +{% if forward_guard or blocklists or firewall.scanners or firewall.greensnow or rl_forward or firewall.block_smtp_out %} chain forward { type filter hook forward priority filter; policy accept; @@ -477,6 +477,15 @@ table inet host { {{ match }} jump drop_log {% endfor %} {% endfor %} +{% if firewall.block_smtp_out %} + + # Pod, container and guest egress to tcp/25 is rejected like the host's own (chain output). Connections DNATed to + # a mail host (ct status dnat) and traffic inside the cluster ring (nodes, pods) pass. + ct status & dnat == 0 ip daddr != @cluster_v4 tcp dport 25 limit rate {{ firewall.log.out_rate }} log prefix "fw-out-reject: " + ct status & dnat == 0 ip daddr != @cluster_v4 tcp dport 25 reject with tcp reset + ct status & dnat == 0 ip6 daddr != @cluster_v6 tcp dport 25 limit rate {{ firewall.log.out_rate }} log prefix "fw-out-reject: " + ct status & dnat == 0 ip6 daddr != @cluster_v6 tcp dport 25 reject with tcp reset +{% endif %} } {% endif %} }