nils/gluon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

gluon-nftables-source-filter: migrate to nftables

Browse Source
This commit is contained in:
Maciej Krüger 2023-05-01 18:23:51 +02:00
parent 7b822a72eb
commit 34c0bc6e36
No known key found for this signature in database
GPG Key ID: 0D948CE19CF49C5F
12 changed files with 40 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
package/gluon-ebtables-source-filter/Makefile
View File

@ -1,17 +0,0 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=gluon-ebtables-source-filter
include ../gluon.mk
define Package/gluon-ebtables-source-filter
TITLE:=Ebtables rules to filter unreasonable L2 traffic.
DEPENDS:=+gluon-core +gluon-ebtables gluon-mesh-batman-adv
endef
define Package/gluon-ebtables-source-filter/description
This package adds an additional layer-2 filter-ruleset to prevent unreasonable
traffic entering the network via the nodes.
endef
$(eval $(call BuildPackageGluon,gluon-ebtables-source-filter))

1
package/gluon-ebtables-source-filter/luasrc/lib/gluon/ebtables/100-local-forward-chain
View File

@ -1 +0,0 @@
chain('LOCAL_FORWARD', 'DROP')

6
package/gluon-ebtables-source-filter/luasrc/lib/gluon/ebtables/110-local-forward-allow-arp
View File

@ -1,6 +0,0 @@
local prefix4 = require('gluon.site').prefix4()
if prefix4 then
rule('LOCAL_FORWARD -p ARP --arp-ip-src ' .. prefix4 .. ' --arp-ip-dst ' .. prefix4 .. ' -j RETURN')
rule('LOCAL_FORWARD -p ARP --arp-ip-src 0.0.0.0 --arp-ip-dst ' .. prefix4 .. ' -j RETURN')
end

6
package/gluon-ebtables-source-filter/luasrc/lib/gluon/ebtables/110-local-forward-allow-ipv4
View File

@ -1,6 +0,0 @@
local prefix4 = require('gluon.site').prefix4()
if prefix4 then
rule('LOCAL_FORWARD -p IPv4 --ip-protocol udp --ip-destination-port 67 -j RETURN')
rule('LOCAL_FORWARD -p IPv4 --ip-src ' .. prefix4 .. ' -j RETURN')
end

9
package/gluon-ebtables-source-filter/luasrc/lib/gluon/ebtables/110-local-forward-allow-ipv6
View File

@ -1,9 +0,0 @@
local site = require 'gluon.site'
rule('LOCAL_FORWARD -p IPv6 --ip6-src fe80::/64 -j RETURN')
rule('LOCAL_FORWARD -p IPv6 --ip6-src ::/128 --ip6-proto ipv6-icmp -j RETURN')
rule('LOCAL_FORWARD -p IPv6 --ip6-src ' .. site.prefix6() .. ' -j RETURN')
for _, prefix in ipairs(site.extra_prefixes6({})) do
rule('LOCAL_FORWARD -p IPv6 --ip6-src ' .. prefix .. ' -j RETURN')
end

1
package/gluon-ebtables-source-filter/luasrc/lib/gluon/ebtables/300-local-forward-rules
View File

@ -1 +0,0 @@
rule('FORWARD --logical-in br-client -i ! bat0 -j LOCAL_FORWARD')

17
package/gluon-nftables-source-filter/Makefile Normal file
View File

@ -0,0 +1,17 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=gluon-nftables-source-filter
include ../gluon.mk
define Package/gluon-nftables-source-filter
TITLE:=nftables rules to filter unreasonable L2 traffic.
DEPENDS:=+gluon-core +gluon-nftables +gluon-mesh-batman-adv
endef
define Package/gluon-nftables-source-filter/description
This package adds an additional layer-2 filter-ruleset to prevent unreasonable
traffic entering the network via the nodes.
endef
$(eval $(call BuildPackageGluon,gluon-nftables-source-filter))

1
package/gluon-nftables-source-filter/luasrc/lib/gluon/nftables/100-local-forward-chain.lua Normal file
View File

@ -0,0 +1 @@
bridge_chain('LOCAL_FORWARD')

6
package/gluon-nftables-source-filter/luasrc/lib/gluon/nftables/110-local-forward-allow-arp.lua Normal file
View File

@ -0,0 +1,6 @@
local prefix4 = require('gluon.site').prefix4()
if prefix4 then
bridge_rule('LOCAL_FORWARD', 'arp saddr ip ' .. prefix4 .. ' arp daddr ip ' .. prefix4 .. ' return')
bridge_rule('LOCAL_FORWARD', 'arp saddr ip 0.0.0.0 arp daddr ip ' .. prefix4 .. ' return')
end

6
package/gluon-nftables-source-filter/luasrc/lib/gluon/nftables/110-local-forward-allow-ipv4.lua Normal file
View File

@ -0,0 +1,6 @@
local prefix4 = require('gluon.site').prefix4()
if prefix4 then
bridge_rule('LOCAL_FORWARD', 'ip version 4 udp dport 67 return')
bridge_rule('LOCAL_FORWARD', 'ip saddr ' .. prefix4 .. ' return')
end

9
package/gluon-nftables-source-filter/luasrc/lib/gluon/nftables/110-local-forward-allow-ipv6.lua Normal file
View File

@ -0,0 +1,9 @@
local site = require 'gluon.site'
bridge_rule('LOCAL_FORWARD', 'ip6 saddr fe80::/64 return')
bridge_rule('LOCAL_FORWARD', 'ip6 saddr ::/128 ip6 nexthdr icmpv6')
bridge_rule('LOCAL_FORWARD', 'ip6 saddr ' .. site.prefix6() .. ' return')
for _, prefix in ipairs(site.extra_prefixes6({})) do
bridge_rule('LOCAL_FORWARD', 'ip6 saddr ' .. prefix .. ' return')
end

1
package/gluon-nftables-source-filter/luasrc/lib/gluon/nftables/300-local-forward-rules.lua Normal file
View File

@ -0,0 +1 @@
bridge_rule('FORWARD', 'ibrname "br-client" iifname != "bat0" jump local_forward')