70 lines
2.4 KiB
Plaintext
70 lines
2.4 KiB
Plaintext
interface wan : WAN { dynamic; };
|
|
interface lan : LAN { cidr4 = { 10.0.0.0/24 }; };
|
|
|
|
zone lan_zone = { lan };
|
|
|
|
let rfc1918 : Set<IPv4> = { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 };
|
|
|
|
-- Single IPv4 port forward: tcp:8080 -> 10.0.0.10:80
|
|
let forwards : Map<(Protocol, Port), (IP, Port)> = {
|
|
(tcp, :8080) -> (10.0.0.10, :80)
|
|
};
|
|
|
|
-- Open inbound ports on the router itself
|
|
let open_ports : Set<Port> = { :22 };
|
|
|
|
-- IPv6 forwarded destination: tcp . 2001:db8::1 . 22000
|
|
let forwards_v6 : Set<(Protocol, IP, Port)> = {
|
|
(tcp, 2001:db8::1, :22000)
|
|
};
|
|
|
|
policy input : Frame
|
|
on { hook = Input, table = Filter, priority = Filter }
|
|
= {
|
|
| _ if ct.state in { Established, Related } -> Allow;
|
|
| Frame(lo, _) -> Allow;
|
|
| Frame(_, IPv6(ip6, ICMPv6(_, _)))
|
|
if ip6.src in fe80::/10 -> Allow;
|
|
| Frame(_, IPv4(_, TCP(tcp, _)))
|
|
if tcp.dport in open_ports -> Allow;
|
|
| Frame(_, IPv4(_, UDP(udp, _)))
|
|
if udp.dport == :51944 -> Allow;
|
|
| _ -> Drop;
|
|
};
|
|
|
|
policy forward : Frame
|
|
on { hook = Forward, table = Filter, priority = Filter }
|
|
= {
|
|
| _ if ct.state in { Established, Related } -> Allow;
|
|
| _ if ct.status == DNAT -> Allow;
|
|
| Frame(iif in lan_zone -> wan, _) -> Allow;
|
|
| Frame(wan -> iif in lan_zone, IPv4(ip, TCP(th, _) | UDP(th, _)))
|
|
if (ip.protocol, th.dport) in forwards -> Allow;
|
|
| Frame(wan -> iif in lan_zone, IPv6(ip6, TCP(th, _) | UDP(th, _)))
|
|
if (ip6.protocol, ip6.dst, th.dport) in forwards_v6 -> Allow;
|
|
| _ -> Drop;
|
|
};
|
|
|
|
policy output : Frame
|
|
on { hook = Output, table = Filter, priority = Filter }
|
|
= {
|
|
| _ -> Allow;
|
|
};
|
|
|
|
policy nat_prerouting : Frame
|
|
on { hook = Prerouting, table = NAT, priority = DstNat }
|
|
= {
|
|
| Frame(_, IPv4(ip, TCP(th, _) | UDP(th, _))) ->
|
|
if perform FIB.daddrLocal(ip.dst)
|
|
then DNATMap((ip.protocol, th.dport), forwards)
|
|
else Allow;
|
|
| _ -> Allow;
|
|
};
|
|
|
|
policy nat_postrouting : Frame
|
|
on { hook = Postrouting, table = NAT, priority = SrcNat }
|
|
= {
|
|
| Frame(_ -> wan, IPv4(ip, _)) if ip.src in rfc1918 -> Masquerade;
|
|
| _ -> Allow;
|
|
};
|