Ruakij/Ansible-roles
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

host_firewall: no_hairpin_ifaces drops forwarding back out of the interface it came in on

Browse Source
This commit is contained in:
Ruakij
2026-11-06 08:33:42 +00:00
parent 252c703afd
commit 79943e0389
2 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
host_firewall/templates/host.nft.j2
+5 -1
View File
@@ -441,10 +441,14 @@ table inet host {
ip6 saddr @geo_v6 accept
{% endif %}
}
{% if forward_guard or blocklists or firewall.scanners or rl_forward or firewall.block_smtp_out %}
{% if forward_guard or blocklists or firewall.scanners or rl_forward or firewall.block_smtp_out or firewall.no_hairpin_ifaces %}
chain forward {
type filter hook forward priority filter; policy accept;
{% for name, iface in firewall.no_hairpin_ifaces.items() %}
iifname "{{ iface }}" oifname "{{ iface }}" counter drop comment "{{ name }}: no forwarding back out of the uplink"
{% endfor %}
{% if rl_forward %}
# Docker-published ports and port forwards arrive here after DNAT; pod and guest egress is not DNATed.