dustin
/
configpolicy
1
1
Fork 0
Code Issues Releases Activity

roles/dch-gw: Explicitly accept forwarded ports 

Marking packets matching port-forwarding rules, and then allowing
traffic carrying that mark did not seem to work well. Often, packets
seemed to get dropped for no apparent reason, and outside connections to
NAT'd services was sometimes slow as a result. Explicitly listing every
destination host/port in the `forward` table seems to resolve this
issue.
jenkins-master
Dustin 2018-04-06 20:13:03 -05:00
parent e9c9445a96
commit b83e832df9
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
roles/dch-gw/templates/forward.nft.j2
View File

@ -16,7 +16,6 @@ table inet filter {
iif != {{ internet_iface }} oifname {{ dch_networks.guest.router_iface }} drop iif != {{ internet_iface }} oifname {{ dch_networks.guest.router_iface }} drop
iif != {{ internet_iface }} oif != {{ internet_iface }} counter accept iif != {{ internet_iface }} oif != {{ internet_iface }} counter accept
ip daddr @firemon counter accept ip daddr @firemon counter accept
mark 323 counter accept
tcp dport smtp counter reject with icmpx type host-unreachable tcp dport smtp counter reject with icmpx type host-unreachable
oif {{ internet_iface }} accept oif {{ internet_iface }} accept
} }

14
roles/dch-gw/templates/port-forwards.nft.j2
View File

@ -33,13 +33,21 @@ table ip nat {
} }
chain prerouting { chain prerouting {
ip daddr $outside_address meta mark set 323 dnat tcp dport map @tcp_forward ip daddr $outside_address dnat tcp dport map @tcp_forward
ip daddr $outside_address meta mark set 323 dnat udp dport map @udp_forward ip daddr $outside_address dnat udp dport map @udp_forward
} }
chain postrouting { chain postrouting {
{% for item in nat_port_forwards %} {% for item in nat_port_forwards %}
ip saddr @inside_networks ip daddr {{ item.destination }} {{ item.protocol|d('tcp') }} dport {{ item.port }} meta mark set 323 masquerade ip saddr @inside_networks ip daddr {{ item.destination }} {{ item.protocol|d('tcp') }} dport {{ item.port }} masquerade
{% endfor %}
}
}
table inet filter {
chain forward {
{% for item in nat_port_forwards %}
ip daddr {{ item.destination }} {{ item.protocol|d('tcp') }} dport {{ item.port }} counter accept
{% endfor %} {% endfor %}
} }
} }