Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: reject forwarded tcp/25 egress like the host output rule

Browse Source
This commit is contained in:
Ruakij
2026-11-03 16:59:44 +00:00
parent c30b3d1f0a
commit 74a0af2d32
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/templates/host.nft.j2
+10 -1
View File
@@ -424,7 +424,7 @@ table inet host {
ip6 saddr @geo_v6 accept ip6 saddr @geo_v6 accept
{% endif %} {% endif %}
} }
{% if forward_guard or blocklists or firewall.scanners or firewall.greensnow or rl_forward %} {% if forward_guard or blocklists or firewall.scanners or firewall.greensnow or rl_forward or firewall.block_smtp_out %}
chain forward { chain forward {
type filter hook forward priority filter; policy accept; type filter hook forward priority filter; policy accept;
@@ -477,6 +477,15 @@ table inet host {
{{ match }} jump drop_log {{ match }} jump drop_log
{% endfor %} {% endfor %}
{% endfor %} {% endfor %}
{% if firewall.block_smtp_out %}
# Pod, container and guest egress to tcp/25 is rejected like the host's own (chain output). Connections DNATed to
# a mail host (ct status dnat) and traffic inside the cluster ring (nodes, pods) pass.
ct status & dnat == 0 ip daddr != @cluster_v4 tcp dport 25 limit rate {{ firewall.log.out_rate }} log prefix "fw-out-reject: "
ct status & dnat == 0 ip daddr != @cluster_v4 tcp dport 25 reject with tcp reset
ct status & dnat == 0 ip6 daddr != @cluster_v6 tcp dport 25 limit rate {{ firewall.log.out_rate }} log prefix "fw-out-reject: "
ct status & dnat == 0 ip6 daddr != @cluster_v6 tcp dport 25 reject with tcp reset
{% endif %}
} }
{% endif %} {% endif %}
} }