From 157fa4eac5efe8984b66bc4e3468b6632f4b9a78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabian=20Bl=C3=A4se?= Date: Sun, 18 Dec 2022 13:46:03 +0100 Subject: [PATCH] fff-firewall: Switch from ip/ebtables to nftables MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Include nftables and appropriate modules. Translate ip- and ebtables rules to their nftables counterparts. Remove ip/ebtables and modules. This change intentionally tries to keep structural changes at a minimum to keep the rule translation comprehensible. kmod-nft-bridge is not required for fff-node, because it was merged into a single kernel module since Linux 4.17: [1] https://github.com/torvalds/linux/commit/02c7b25e5f54321b9063e18d4f52cce07f8e081d [2] https://github.com/openwrt/openwrt/commit/fbaf48387eb5e0e2bdc90d4c6f985a242a9fb0cc Fixes: #252 Signed-off-by: Fabian Bläse Co-authored-by: Johannes Kimmel --- src/packages/fff/fff-base/Makefile | 2 - src/packages/fff/fff-firewall/Makefile | 6 +- .../files/usr/lib/firewall.d/00-prepare | 9 +-- .../files/usr/lib/firewall.d/30-gateway-fe801 | 18 ++++-- src/packages/fff/fff-layer3-snat/Makefile | 2 +- .../files/usr/lib/firewall.d/30-snat | 10 ++- src/packages/fff/fff-layer3/Makefile | 8 --- .../usr/lib/firewall.d/10-no-forward-wan | 9 ++- .../usr/lib/firewall.d/05-setup-batman-chains | 62 +++++++++++-------- .../usr/lib/firewall.d/06-disable-forwarding | 14 ++++- .../files/usr/lib/firewall.d/30-client-dhcp | 23 +++++-- .../files/usr/lib/firewall.d/30-client-dhcpv6 | 23 +++++-- .../files/usr/lib/firewall.d/30-client-ra | 16 +++-- .../files/usr/lib/firewall.d/31-node-dhcp | 18 ++++-- .../files/usr/lib/firewall.d/31-node-dhcpv6 | 18 ++++-- .../files/usr/lib/firewall.d/31-node-ra | 28 ++++++--- .../fff-node/files/usr/lib/firewall.d/35-mc | 17 +++-- .../files/usr/lib/firewall.d/35-mc-arp | 21 +++++-- .../files/usr/lib/firewall.d/35-mc-ping | 17 +++-- .../files/usr/lib/firewall.d/36-mc-policy | 8 +++ .../files/usr/lib/firewall.d/40-local-node | 37 ++++++++--- .../files/usr/lib/firewall.d/40-nft-counter | 15 +++++ .../files/usr/lib/firewall.d/32-local-ra | 18 ++++-- 23 files changed, 280 insertions(+), 119 deletions(-) create mode 100644 src/packages/fff/fff-node/files/usr/lib/firewall.d/36-mc-policy create mode 100644 src/packages/fff/fff-node/files/usr/lib/firewall.d/40-nft-counter diff --git a/src/packages/fff/fff-base/Makefile b/src/packages/fff/fff-base/Makefile index ff7e810e..29f06746 100644 --- a/src/packages/fff/fff-base/Makefile +++ b/src/packages/fff/fff-base/Makefile @@ -12,8 +12,6 @@ define Package/fff-base URL:=https://www.freifunk-franken.de DEFAULT:=y DEPENDS:= \ - +iptables-legacy \ - +ip6tables-legacy \ +micrond \ +odhcp6c \ +fff-config \ diff --git a/src/packages/fff/fff-firewall/Makefile b/src/packages/fff/fff-firewall/Makefile index 1bb42d57..89275474 100644 --- a/src/packages/fff/fff-firewall/Makefile +++ b/src/packages/fff/fff-firewall/Makefile @@ -10,11 +10,7 @@ define Package/$(PKG_NAME) CATEGORY:=Freifunk TITLE:=Freifunk-Franken firewall URL:=https://www.freifunk-franken.de - DEPENDS:=+arptables-legacy \ - +ebtables-legacy +ebtables-legacy-utils \ - +kmod-ebtables-ipv4 +kmod-ebtables-ipv6 \ - +iptables-mod-filter +iptables-mod-ipopt +iptables-mod-conntrack-extra \ - +kmod-nf-conntrack6 + DEPENDS:=+nftables endef define Package/$(PKG_NAME)/description diff --git a/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/00-prepare b/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/00-prepare index c2175f62..38578cc1 100644 --- a/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/00-prepare +++ b/src/packages/fff/fff-firewall/files/usr/lib/firewall.d/00-prepare @@ -1,6 +1,3 @@ -######## CLEAN UP ############ -ebtables -F -ebtables -X - -iptables-save | awk '/^[*]/ { print $1 } /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; } /COMMIT/ { print $0; }' | iptables-restore -ip6tables-save | awk '/^[*]/ { print $1 } /^:[A-Z]+ [^-]/ { print $1 " ACCEPT" ; } /COMMIT/ { print $0; }' | ip6tables-restore +nft -f - <<__EOF +flush ruleset +__EOF diff --git a/src/packages/fff/fff-hoods/files/usr/lib/firewall.d/30-gateway-fe801 b/src/packages/fff/fff-hoods/files/usr/lib/firewall.d/30-gateway-fe801 index 0be1e6cb..15621305 100644 --- a/src/packages/fff/fff-hoods/files/usr/lib/firewall.d/30-gateway-fe801 +++ b/src/packages/fff/fff-hoods/files/usr/lib/firewall.d/30-gateway-fe801 @@ -1,5 +1,15 @@ -# Erlaube nur fe80::1 von BATMAN -> CLIENT -ebtables -A FORWARD -p IPv6 --ip6-source fe80::1 -j IN_ONLY +nft -f - <<__EOF +table bridge filter { + chain INPUT { + # Erlaube nur fe80::1 von BATMAN -> CLIENT + # -p IPv6 --ip6-src fe80::1 -j IN_ONLY + ether type ip6 ip6 saddr fe80::1 counter jump IN_ONLY + } -# Erlaube nur fe80::1 von KNOTEN -> CLIENT -ebtables -A INPUT -p IPv6 --ip6-source fe80::1 -j IN_ONLY + chain FORWARD { + # Erlaube nur fe80::1 von KNOTEN -> CLIENT + # -p IPv6 --ip6-src fe80::1 -j IN_ONLY + ether type ip6 ip6 saddr fe80::1 counter jump IN_ONLY + } +} +__EOF diff --git a/src/packages/fff/fff-layer3-snat/Makefile b/src/packages/fff/fff-layer3-snat/Makefile index b1f27570..4340568d 100644 --- a/src/packages/fff/fff-layer3-snat/Makefile +++ b/src/packages/fff/fff-layer3-snat/Makefile @@ -13,7 +13,7 @@ define Package/fff-layer3-snat DEPENDS:= \ +fff-firewall \ +fff-layer3-config \ - +kmod-ipt-nat + +kmod-nft-nat endef define Package/fff-layer3-snat/description diff --git a/src/packages/fff/fff-layer3-snat/files/usr/lib/firewall.d/30-snat b/src/packages/fff/fff-layer3-snat/files/usr/lib/firewall.d/30-snat index b4ec9799..23c765e9 100644 --- a/src/packages/fff/fff-layer3-snat/files/usr/lib/firewall.d/30-snat +++ b/src/packages/fff/fff-layer3-snat/files/usr/lib/firewall.d/30-snat @@ -1,4 +1,10 @@ if [ "$(uci -q get network.client.fff_snat)" = '1' ]; then - iptables -t mangle -A PREROUTING -i br-client -j MARK --set-mark 0x736e6174 - iptables -t nat -A POSTROUTING -m mark --mark 0x736e6174 -j SNAT --to-source $(uci -q get network.client.fff_snat_sourceip) + nft add table ip mangle + nft add chain ip mangle PREROUTING '{ type filter hook prerouting priority mangle; policy accept; }' + + nft add table ip nat + nft add chain ip nat POSTROUTING '{ type nat hook postrouting priority srcnat; policy accept; }' + + nft add rule ip mangle PREROUTING iifname "br-client" counter mark set 0x736e6174 + nft add rule ip nat POSTROUTING meta mark 0x736e6174 counter snat ip to $(uci -q get network.client.fff_snat_sourceip) fi diff --git a/src/packages/fff/fff-layer3/Makefile b/src/packages/fff/fff-layer3/Makefile index e01ed84f..ad74804e 100644 --- a/src/packages/fff/fff-layer3/Makefile +++ b/src/packages/fff/fff-layer3/Makefile @@ -23,21 +23,13 @@ define Package/fff-layer3 +fff-ra \ +fff-web-mqtt \ +fff-wireguard \ - +arptables-legacy \ +bmon \ - +ebtables-legacy \ - +ebtables-legacy-utils \ - +kmod-ebtables-ipv4 \ - +kmod-ebtables-ipv6 \ +kmod-sched-cake \ +gre \ +@PACKAGE_grev4 \ +@PACKAGE_grev6 \ +iperf3 \ +ip-full \ - +iptables-mod-filter \ - +iptables-mod-ipopt \ - +iptables-mod-conntrack-extra \ +mtr \ +nftables \ +snmp-utils \ diff --git a/src/packages/fff/fff-layer3/files/usr/lib/firewall.d/10-no-forward-wan b/src/packages/fff/fff-layer3/files/usr/lib/firewall.d/10-no-forward-wan index 2d4ee926..55a43d00 100644 --- a/src/packages/fff/fff-layer3/files/usr/lib/firewall.d/10-no-forward-wan +++ b/src/packages/fff/fff-layer3/files/usr/lib/firewall.d/10-no-forward-wan @@ -1,5 +1,10 @@ # Ensure nothing is forwarded onto WAN interface if [ -n "$IF_WAN" ]; then - iptables -A FORWARD -o $IF_WAN -j REJECT --reject-with icmp-net-unreachable - ip6tables -A FORWARD -o $IF_WAN -j REJECT --reject-with no-route + nft add table ip filter + nft add chain ip filter FORWARD '{ type filter hook forward priority filter; policy accept; }' + nft add table ip6 filter + nft add chain ip6 filter FORWARD '{ type filter hook forward priority filter; policy accept; }' + + nft add rule ip filter FORWARD oifname "$IF_WAN" counter reject with icmp net-unreachable + nft add rule ip6 filter FORWARD oifname "$IF_WAN" counter reject with icmpv6 no-route fi diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/05-setup-batman-chains b/src/packages/fff/fff-node/files/usr/lib/firewall.d/05-setup-batman-chains index 5db92968..68867341 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/05-setup-batman-chains +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/05-setup-batman-chains @@ -1,34 +1,44 @@ -######## IN_ONLY ############ -ebtables -N IN_ONLY -P RETURN +nft -f - <<__EOF +table bridge filter { + # IN_ONLY wird angesprungen, wenn dieses Paket nur + # vom Gateway (also vom BATMAN) kommen darf. + chain IN_ONLY { + # -i ! bat0 --logical-in br-client -j DROP + iifname != "bat0" counter drop + counter + } -# Daten aus dem BATMAN werden erlaubt -# Alles ausser Daten von BATMAN werden DROP'ed -ebtables -A IN_ONLY -i ! bat0 --logical-in br-client -j DROP + # OUT_ONLY wird angesprungen, wenn dieses Paket nur + # in Richtung Gateway (also ins BATMAN) gesendet werden darf. + chain OUT_ONLY { + # --logical-out br-client -o ! bat0 -j DROP + oifname != "bat0" counter drop + counter + } -######## OUT_ONLY ############ -ebtables -N OUT_ONLY -P RETURN + # MULTICAST_OUT filtert/reduziert Multicast-Frames, die ins BATMAN gesendet werden. + chain MULTICAST_OUT { + } -# Daten ins BATMAN werden erlaubt -# Alles ausser Daten ins BATMAN werden DROP'ed -ebtables -A OUT_ONLY --logical-out br-client -o ! bat0 -j DROP + chain INPUT { + type filter hook input priority filter; policy accept; -######## MULTICAST_OUT ############ -ebtables -N MULTICAST_OUT -P DROP + # -d Multicast -i ! bat0 --logical-in br-client -j ACCEPT + iifname != "bat0" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 counter packets 0 bytes 0 accept + } -######## INPUT ############ -ebtables -P INPUT ACCEPT + chain FORWARD { + type filter hook forward priority filter; policy accept; -# Regelt alles was an Multicast/Broadcast von CLIENT -> KNOTEN geht bei MULTICAST_OUT -ebtables -A INPUT -d Multicast --logical-in br-client -i ! bat0 -j ACCEPT + # -d Multicast --logical-out br-client -o bat0 -j MULTICAST_OUT + oifname "bat0" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 counter packets 0 bytes 0 jump MULTICAST_OUT + } -######## FORWARD ############ -ebtables -P FORWARD ACCEPT + chain OUTPUT { + type filter hook output priority filter; policy accept; -# Regelt alles was an Multicast/Broadcast von CLIENT -> BATMAN geht bei MULTICAST_OUT -ebtables -A FORWARD -d Multicast --logical-out br-client -o bat0 -j MULTICAST_OUT - -######## OUTPUT ############ -ebtables -P OUTPUT ACCEPT - -# Regelt alles was an Multicast/Broadcast von KNOTEN -> BATMAN geht bei MULTICAST_OUT -ebtables -A OUTPUT -d Multicast --logical-out br-client -o bat0 -j MULTICAST_OUT + # -d Multicast --logical-out br-client -o bat0 -j MULTICAST_OUT + oifname "bat0" ether daddr & 01:00:00:00:00:00 == 01:00:00:00:00:00 counter jump MULTICAST_OUT + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/06-disable-forwarding b/src/packages/fff/fff-node/files/usr/lib/firewall.d/06-disable-forwarding index 083db822..26aacc0a 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/06-disable-forwarding +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/06-disable-forwarding @@ -1,2 +1,12 @@ -/usr/sbin/iptables -P FORWARD DROP -/usr/sbin/ip6tables -P FORWARD DROP +nft -f - <<__EOF +table ip filter { + chain FORWARD { + type filter hook forward priority filter; policy drop; + } +} +table ip6 filter { + chain FORWARD { + type filter hook forward priority filter; policy drop; + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-dhcp b/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-dhcp index a50c799f..68f1387b 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-dhcp +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-dhcp @@ -1,8 +1,19 @@ -# Erlaube DHCP Requests -ebtables -A MULTICAST_OUT -p IPv4 --ip-proto udp --ip-dport 67 -j RETURN +nft -f - <<__EOF +table bridge filter { + chain MULTICAST_OUT { + # Erlaube DHCP Requests + # -p IPv4 --ip-proto udp --ip-dport 67 -j RETURN + ether type ip udp dport 67 counter return + } -# Erlaube nur DHCP Request von CLIENT -> BATMAN -ebtables -A FORWARD -p IPv4 --ip-proto udp --ip-dport 67 -j OUT_ONLY + chain FORWARD { + # Erlaube nur DHCP Request von CLIENT -> BATMAN + # -p IPv4 --ip-proto udp --ip-dport 67 -j OUT_ONLY + ether type ip udp dport 67 counter jump OUT_ONLY -# Erlaube nur DHCP Antworten von BATMAN -> CLIENT -ebtables -A FORWARD -p IPv4 --ip-proto udp --ip-dport 68 -j IN_ONLY + # Erlaube nur DHCP Antworten von BATMAN -> CLIENT + # -p IPv4 --ip-proto udp --ip-dport 68 -j IN_ONLY + ether type ip udp dport 68 counter jump IN_ONLY + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-dhcpv6 b/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-dhcpv6 index 068ef06e..cb4ac9b1 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-dhcpv6 +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-dhcpv6 @@ -1,8 +1,19 @@ -# Erlaube DHCPv6 Requests -ebtables -A MULTICAST_OUT -p IPv6 --ip6-proto udp --ip6-dport 547 -j RETURN +nft -f - <<__EOF +table bridge filter { + chain MULTICAST_OUT { + # Erlaube DHCPv6 Requests + # -p IPv6 --ip6-proto udp --ip6-dport 547 -j RETURN + ether type ip6 udp dport 547 counter return + } -# Erlaube nur DHCPv6 Request von CLIENT -> BATMAN -ebtables -A FORWARD -p IPv6 --ip6-proto udp --ip6-dport 547 -j OUT_ONLY + chain FORWARD { + # Erlaube nur DHCPv6 Request von CLIENT -> BATMAN + # -p IPv6 --ip6-proto udp --ip6-dport 547 -j OUT_ONLY + ether type ip6 udp dport 547 counter jump OUT_ONLY -# Erlaube nur DHCPv6 Antworten von BATMAN -> CLIENT -ebtables -A FORWARD -p IPv6 --ip6-proto udp --ip6-dport 546 -j IN_ONLY + # Erlaube nur DHCPv6 Antworten von BATMAN -> CLIENT + # -p IPv6 --ip6-proto udp --ip6-dport 546 -j IN_ONLY + ether type ip6 udp dport 546 counter jump IN_ONLY + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-ra b/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-ra index 29562ded..8ea5aef2 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-ra +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/30-client-ra @@ -1,5 +1,13 @@ -# Erlaube nur Router-Solicitation von CLIENT -> BATMAN -ebtables -A FORWARD -p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY +nft -f - <<__EOF +table bridge filter { + chain FORWARD { + # Erlaube nur Router-Solicitation von CLIENT -> BATMAN + # -p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY + ether type ip6 icmpv6 type nd-router-solicit counter jump OUT_ONLY -# Erlaube nur Router-Advertisment von BATMAN -> CLIENT -ebtables -A FORWARD -p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY + # Erlaube nur Router-Advertisment von BATMAN -> CLIENT + # -p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY + ether type ip6 icmpv6 type nd-router-advert counter jump IN_ONLY + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-dhcp b/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-dhcp index 9280a918..045fdc39 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-dhcp +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-dhcp @@ -1,5 +1,15 @@ -# Erlaube nur DHCP Antworten von BATMAN -> KNOTEN -ebtables -A INPUT -p IPv4 --ip-proto udp --ip-dport 68 -j IN_ONLY +nft -f - <<__EOF +table bridge filter { + chain INPUT { + # Erlaube nur DHCP Antworten von BATMAN -> KNOTEN + # -p IPv4 --ip-proto udp --ip-dport 68 -j IN_ONLY + ether type ip udp dport 68 counter jump IN_ONLY + } -# Erlaube nur DHCP Request von KNOTEN -> BATMAN -ebtables -A OUTPUT -p IPv4 --ip-proto udp --ip-dport 67 -j OUT_ONLY + chain OUTPUT { + # Erlaube nur DHCP Request von KNOTEN -> BATMAN + # -p IPv4 --ip-proto udp --ip-dport 67 -j OUT_ONLY + ether type ip udp dport 67 counter jump OUT_ONLY + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-dhcpv6 b/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-dhcpv6 index 97c3df35..05913de4 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-dhcpv6 +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-dhcpv6 @@ -1,5 +1,15 @@ -# Erlaube nur DHCPv6 Antworten von BATMAN -> KNOTEN -ebtables -A INPUT -p IPv6 --ip6-proto udp --ip6-dport 546 -j IN_ONLY +nft -f - <<__EOF +table bridge filter { + chain INPUT { + # Erlaube nur DHCPv6 Antworten von BATMAN -> KNOTEN + # -p IPv6 --ip6-proto udp --ip6-dport 546 -j IN_ONLY + ether type ip6 udp dport 546 counter jump IN_ONLY + } -# Erlaube nur DHCPv6 Request von KNOTEN -> BATMAN -ebtables -A OUTPUT -p IPv6 --ip6-proto udp --ip6-dport 547 -j OUT_ONLY + chain OUTPUT { + # Erlaube nur DHCPv6 Request von KNOTEN -> BATMAN + # -p IPv6 --ip6-proto udp --ip6-dport 547 -j OUT_ONLY + ether type ip6 udp dport 547 counter jump OUT_ONLY + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-ra b/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-ra index e619201c..86e4266c 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-ra +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/31-node-ra @@ -1,11 +1,23 @@ -# Erlaube nur Router-Advertisment von BATMAN -> KNOTEN -ebtables -A INPUT -p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY +nft -f - <<__EOF +table bridge filter { + chain INPUT { + # Erlaube nur Router-Advertisment von BATMAN -> KNOTEN + # -p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type router-advertisement -j IN_ONLY + ether type ip6 ip6 nexthdr icmpv6 icmpv6 type nd-router-advert counter jump IN_ONLY -# Verbiete Router-Solicitation von BATMAN -> KNOTEN -ebtables -A INPUT -p IPv6 -i bat0 --ip6-proto ipv6-icmp --ip6-icmp-type router-solicitation -j DROP + # Verbiete Router-Solicitation von BATMAN -> KNOTEN + # -p IPv6 -i bat0 --ip6-proto ipv6-icmp --ip6-icmp-type router-solicitation -j DROP + iifname "bat0" ether type ip6 ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit counter drop + } -# Erlaube nur Router-Solicitation von KNOTEN -> BATMAN -ebtables -A OUTPUT -p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY + chain OUTPUT { + # Erlaube nur Router-Solicitation von KNOTEN -> BATMAN + # -p IPv6 --ip6-proto ipv6-icmp --ip6-icmp-type router-solicitation -j OUT_ONLY + ether type ip6 icmpv6 type nd-router-solicit counter jump OUT_ONLY -# Verbiete Router-Advertisment von KNOTEN -> BATMAN -ebtables -A OUTPUT -p IPv6 -o bat0 --ip6-proto ipv6-icmp --ip6-icmp-type router-advertisement -j DROP + # Verbiete Router-Advertisment von KNOTEN -> BATMAN + # -p IPv6 -o bat0 --ip6-proto ipv6-icmp --ip6-icmp-type router-advertisement -j DROP + oifname "bat0" ether type ip6 icmpv6 type nd-router-advert counter drop + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc b/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc index 50cc31f8..6bd68d37 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc @@ -1,6 +1,13 @@ -# Erlaube alles was nicht IP ?? ist " hop-by-hop " ?? -ebtables -A MULTICAST_OUT -p IPv6 --ip6-proto 0 -j RETURN - -# Erlaube Organisation der Multicast Gruppen -ebtables -A MULTICAST_OUT -p IPv4 --ip-proto igmp -j RETURN +nft -f - <<__EOF +table bridge filter { + chain MULTICAST_OUT { + # Erlaube alles was nicht IP ?? ist " hop-by-hop " ?? + # -p IPv6 --ip6-proto ip -j RETURN + ether type ip6 ip6 nexthdr 0 counter return + # Erlaube Organisation der Multicast Gruppen + # -p IPv4 --ip-proto igmp -j RETURN + ether type ip meta l4proto igmp counter return + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc-arp b/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc-arp index 50e0191e..84b01faf 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc-arp +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc-arp @@ -1,8 +1,17 @@ -# Verbiete ARP Antworten an alle -ebtables -A MULTICAST_OUT -p ARP --arp-op Reply --arp-ip-src 0.0.0.0 -j DROP +nft -f - <<__EOF +table bridge filter { + chain MULTICAST_OUT { + # Verbiete ARP Antworten an alle + # -p ARP --arp-op Reply --arp-ip-src 0.0.0.0 -j DROP + ether type arp arp operation reply arp daddr ip 0.0.0.0 counter drop -# Verbiete ARP Requests an alle -ebtables -A MULTICAST_OUT -p ARP --arp-op Request --arp-ip-dst 0.0.0.0 -j DROP + # Verbiete ARP Requests an alle + # -p ARP --arp-op Request --arp-ip-dst 0.0.0.0 -j DROP + ether type arp arp operation request arp daddr ip 0.0.0.0 counter drop -# Erlaube alle anderen ARP's -ebtables -A MULTICAST_OUT -p ARP -j RETURN + # Erlaube alle anderen ARP's + # -p ARP -j RETURN + ether type arp counter return + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc-ping b/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc-ping index 877b0276..c45baf6a 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc-ping +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/35-mc-ping @@ -1,6 +1,13 @@ -# Erlaube PING -ebtables -A MULTICAST_OUT -p IPv4 --ip-proto icmp -j RETURN - -# Erlaube PINGv6 -ebtables -A MULTICAST_OUT -p IPv6 --ip6-proto ipv6-icmp -j RETURN +nft -f - <<__EOF +table bridge filter { + chain MULTICAST_OUT { + # Erlaube PING + # -p IPv4 --ip-proto icmp -j RETURN + ether type ip meta l4proto icmp counter return + # Erlaube PINGv6 + # -p IPv6 --ip6-proto ipv6-icmp -j RETURN + ether type ip6 meta l4proto icmpv6 counter return + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/36-mc-policy b/src/packages/fff/fff-node/files/usr/lib/firewall.d/36-mc-policy new file mode 100644 index 00000000..dc3e24f0 --- /dev/null +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/36-mc-policy @@ -0,0 +1,8 @@ +nft -f - <<__EOF +table bridge filter { + chain MULTICAST_OUT { + # policy: DROP + counter drop + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/40-local-node b/src/packages/fff/fff-node/files/usr/lib/firewall.d/40-local-node index 33c4a6d9..b5e733fc 100644 --- a/src/packages/fff/fff-node/files/usr/lib/firewall.d/40-local-node +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/40-local-node @@ -1,11 +1,30 @@ -# No input from/to local node ip from batman -ebtables -A INPUT --logical-in br-client -i bat0 -p IPv6 --ip6-source fdff::1/128 -j DROP -ebtables -A INPUT --logical-in br-client -i bat0 -p IPv6 --ip6-destination fdff::1/128 -j DROP +nft -f - <<__EOF +table bridge filter { + chain INPUT { + # No input from/to local node ip from batman -# Do not forward local node ip -ebtables -A FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-destination fdff::1/128 -j DROP -ebtables -A FORWARD --logical-out br-client -o bat0 -p IPv6 --ip6-source fdff::1/128 -j DROP + # -p IPv6 -i bat0 --logical-in br-client --ip6-src fdff::1 -j DROP + iifname "bat0" ether type ip6 ip6 saddr fdff::1 counter drop + # -p IPv6 -i bat0 --logical-in br-client --ip6-dst fdff::1 -j DROP + iifname "bat0" ether type ip6 ip6 daddr fdff::1 counter drop + } -# Do not output local node ip to batman -ebtables -A OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-destination fdff::1/128 -j DROP -ebtables -A OUTPUT --logical-out br-client -o bat0 -p IPv6 --ip6-source fdff::1/128 -j DROP + chain FORWARD { + # Do not forward local node ip + + # -p IPv6 --logical-out br-client -o bat0 --ip6-dst fdff::1 -j DROP + oifname "bat0" ether type ip6 ip6 daddr fdff::1 counter drop + # -p IPv6 --logical-out br-client -o bat0 --ip6-src fdff::1 -j DROP + oifname "bat0" ether type ip6 ip6 saddr fdff::1 counter drop + } + + chain OUTPUT { + # Do not output local node ip to batman + + # -p IPv6 --logical-out br-client -o bat0 --ip6-dst fdff::1 -j DROP + oifname "bat0" ether type ip6 ip6 daddr fdff::1 counter drop + # -p IPv6 --logical-out br-client -o bat0 --ip6-src fdff::1 -j DROP + oifname "bat0" ether type ip6 ip6 saddr fdff::1 counter drop + } +} +__EOF diff --git a/src/packages/fff/fff-node/files/usr/lib/firewall.d/40-nft-counter b/src/packages/fff/fff-node/files/usr/lib/firewall.d/40-nft-counter new file mode 100644 index 00000000..b08bfb1d --- /dev/null +++ b/src/packages/fff/fff-node/files/usr/lib/firewall.d/40-nft-counter @@ -0,0 +1,15 @@ +nft -f - <<__EOF +table bridge filter { + chain INPUT { + counter + } + + chain FORWARD { + counter + } + + chain OUTPUT { + counter + } +} +__EOF diff --git a/src/packages/fff/fff-uradvd/files/usr/lib/firewall.d/32-local-ra b/src/packages/fff/fff-uradvd/files/usr/lib/firewall.d/32-local-ra index ae2dba25..37b230ba 100644 --- a/src/packages/fff/fff-uradvd/files/usr/lib/firewall.d/32-local-ra +++ b/src/packages/fff/fff-uradvd/files/usr/lib/firewall.d/32-local-ra @@ -1,5 +1,15 @@ -# Erlaube router solicitation von client zu knoten -ebtables -A INPUT -p IPv6 -i ! bat0 --ip6-proto ipv6-icmp --ip6-icmp-type router-solicitation -j ACCEPT +nft -f - <<__EOF +table bridge filter { + chain INPUT { + # Erlaube router solicitation von client zu knoten + # -p IPv6 -i ! bat0 --ip6-proto ipv6-icmp --ip6-icmp-type router-solicitation -j ACCEPT + iifname != "bat0" ether type ip6 ip6 nexthdr icmpv6 icmpv6 type nd-router-solicit counter accept + } -# Erlaube router advertisment von knoten zu client -ebtables -A OUTPUT -p IPv6 -o ! bat0 --ip6-proto ipv6-icmp --ip6-icmp-type router-advertisement -j ACCEPT + chain OUTPUT { + # Erlaube router advertisment von knoten zu client + # -p IPv6 -o ! bat0 --ip6-proto ipv6-icmp --ip6-icmp-type router-advertisement -j ACCEPT + oifname != "bat0" ether type ip6 icmpv6 type nd-router-advert counter accept + } +} +__EOF