Dustin C. Hatch
b83e832df9
Marking packets matching port-forwarding rules, and then allowing traffic carrying that mark did not seem to work well. Often, packets seemed to get dropped for no apparent reason, and outside connections to NAT'd services was sometimes slow as a result. Explicitly listing every destination host/port in the `forward` table seems to resolve this issue.
23 lines
712 B
Django/Jinja
23 lines
712 B
Django/Jinja
{#- vim: set sw=4 ts=4 sts=4 et : #}
|
|
table inet filter {
|
|
set firemon {
|
|
type ipv4_addr
|
|
flags interval
|
|
elements = {
|
|
{% for prefix in firemon_networks %}
|
|
{{ prefix }},
|
|
{% endfor %}
|
|
}
|
|
}
|
|
|
|
chain forward {
|
|
ct state established,related accept
|
|
iifname {{ dch_networks.guest.router_iface }} oif != {{ internet_iface }} drop
|
|
iif != {{ internet_iface }} oifname {{ dch_networks.guest.router_iface }} drop
|
|
iif != {{ internet_iface }} oif != {{ internet_iface }} counter accept
|
|
ip daddr @firemon counter accept
|
|
tcp dport smtp counter reject with icmpx type host-unreachable
|
|
oif {{ internet_iface }} accept
|
|
}
|
|
}
|