layer3: add option to enable stateful firewall on client network #284

jkimmel · 2023-04-11T10:44:07+02:00

jkimmel commented

2023-04-11 10:44:07 +02:00

Add the following option to the client config section in
/etc/config/gateway to enable a basic stateful firewall:

config client
    option stateful_firewall '1'

The firewall will forward icmp mesages and allow any outbound client
traffic and related inbound traffic.

Add the following option to the client config section in `/etc/config/gateway` to enable a basic stateful firewall: ``` config client option stateful_firewall '1' ``` The firewall will forward icmp mesages and allow any outbound client traffic and related inbound traffic.

jkimmel added the

labels 2023-04-11 10:44:07 +02:00

jkimmel added 1 commit 2023-04-11 10:44:08 +02:00

WIP: fff-firewall: Switch from ip/ebtables to nftables

ci/woodpecker/pr/woodpecker Pipeline was successful

Details

8be918ad49

Include nftables and appropriate modules. Translate ip- and ebtables
rules to their nftables counterparts. Remove ip/ebtables and modules.

This change intentionally tries to keep structural changes at a minimum
to keep the rule translation comprehensible.

kmod-nft-bridge is not required for fff-node, because it was merged into
a single kernel module since Linux 4.17:
[1] 02c7b25e5f
[2] fbaf48387e

Fixes: #252

Signed-off-by: Fabian Bläse <fabian@blaese.de>
Co-authored-by: Johannes Kimmel <fff@bareminimum.eu>

fbl requested review from fbl 2023-04-11 10:44:52 +02:00

jkimmel added a new dependency 2023-04-11 18:08:04 +02:00

#275 fff-firewall: Switch from ip/ebtables to nftables

rohammer reviewed 2023-04-12 09:49:05 +02:00

jkimmel force-pushed stateful-firewall from 2f9cf3c091 to eaa40f7034

2023-04-12 10:01:18 +02:00

Compare

fbl commented

2023-05-20 12:04:46 +02:00

Acked-by: Fabian Bläse <fabian@blaese.de>

`Acked-by: Fabian Bläse <fabian@blaese.de>`

fbl added this to the 20240119-beta milestone 2023-05-20 12:05:05 +02:00