firmware/src/packages/fff/fff-node/files/usr/lib/firewall.d/06-disable-forwarding

nft -f - <<__EOF
table ip filter {
	chain FORWARD {
		type filter hook forward priority filter; policy drop;
	}
}
table ip6 filter {
	chain FORWARD {
		type filter hook forward priority filter; policy drop;
	}
}
__EOF
fff-firewall: Switch from ip/ebtables to nftables Include nftables and appropriate modules. Translate ip- and ebtables rules to their nftables counterparts. Remove ip/ebtables and modules. This change intentionally tries to keep structural changes at a minimum to keep the rule translation comprehensible. kmod-nft-bridge is not required for fff-node, because it was merged into a single kernel module since Linux 4.17: [1] https://github.com/torvalds/linux/commit/02c7b25e5f54321b9063e18d4f52cce07f8e081d [2] https://github.com/openwrt/openwrt/commit/fbaf48387eb5e0e2bdc90d4c6f985a242a9fb0cc Fixes: #252 Signed-off-by: Fabian Bläse <fabian@blaese.de> Co-authored-by: Johannes Kimmel <fff@bareminimum.eu> 2022-12-18 13:46:03 +01:00			`nft -f - <<__EOF`
			`table ip filter {`
			`chain FORWARD {`
			`type filter hook forward priority filter; policy drop;`
			`}`
			`}`
			`table ip6 filter {`
			`chain FORWARD {`
			`type filter hook forward priority filter; policy drop;`
			`}`
			`}`
			`__EOF`