# tomswall configuration # Spiritual successor to shorewall — manages nftables directly settings: # address_family: inet (default), ip (IPv4 only), ip6 (IPv6 only) address_family: inet ip_forwarding: true log_level: info table_name: tomswall implicit_continue: false # Named port groups — reusable port+protocol combos referenced in rules portgroups: web: proto: tcp ports: [80, 443] dns_udp: proto: udp ports: [53] dns_tcp: proto: tcp ports: [53] ssh: proto: tcp ports: [22] mail: proto: tcp ports: [25, 465, 587, 993, 995] high_ports: proto: tcp ports: ["1024-65535"] # Security zones (replaces /etc/shorewall/zones) # Child zones are listed before parents; nesting via parents field. zones: fw: type: firewall net: type: ip loc: type: ip dmz: type: ip # Example nested zone: sam is a sub-zone of net # sam: # type: ip # parents: [net] # Interface-to-zone mappings (replaces /etc/shorewall/interfaces) interfaces: - zone: net interface: eth0 options: dhcp: true nosmurfs: true routefilter: 1 logmartians: true - zone: loc interface: eth1 options: mss: 1400 - zone: dmz interface: eth2 # Host definitions (replaces /etc/shorewall/hosts) # Only needed when multiple zones share an interface. hosts: - zone: loc interface: eth1 addresses: - 192.168.1.0/24 # Default zone-to-zone policies (replaces /etc/shorewall/policy) # Evaluated in order; first match wins. # Intra-zone traffic is implicitly ACCEPTed unless overridden with all+. policy: - source: fw dest: all action: accept - source: loc dest: net action: accept - source: loc dest: fw action: accept - source: net dest: all action: drop log: info - source: all dest: all action: reject log: info # Specific traffic rules (replaces /etc/shorewall/rules) rules: - action: accept source: loc dest: fw portgroup: ssh - action: accept source: loc dest: net portgroup: dns_udp - action: accept source: loc dest: net portgroup: dns_tcp - action: accept source: net dest: dmz portgroup: web - action: accept source: loc dest: fw proto: icmp - action: drop source: net dest: all proto: icmp # DNAT: forward port 2222 from net to loc host on port 22 # - action: dnat # source: net # dest: loc:192.168.1.3:22 # proto: tcp # dport: [2222] # Time-restricted rule example # - action: accept # source: loc # dest: net # portgroup: web # time: # weekdays: [Mon, Tue, Wed, Thu, Fri] # start: "08:00" # stop: "18:00" # Source NAT rules (replaces /etc/shorewall/snat) # First match wins. snat: - action: masquerade source: 192.168.1.0/24 dest: eth0 # Load-balanced SNAT across multiple addresses # - action: snat # address: 1.1.1.1 # source: 192.168.1.0/24 # dest: eth0 # probability: 0.5 # - action: snat # address: 1.1.1.2 # source: 192.168.1.0/24 # dest: eth0 # One-to-one static NAT (replaces /etc/shorewall/nat) # Maps an external IP to an internal IP bidirectionally. # DNAT rules take precedence over static NAT. # nat: # - external: 203.0.113.10 # interface: eth0 # internal: 192.168.1.10 # all_interfaces: false # local: true # Network-to-network address mapping (replaces /etc/shorewall/netmap) # Maps one subnet to another at the IP header level. # netmap: # - type: dnat # net1: 10.0.0.0/24 # interface: eth0 # net2: 192.168.1.0/24 # - type: snat # net1: 192.168.1.0/24 # interface: eth0 # net2: 10.0.0.0/24 # Variables (replaces /etc/shorewall/params) # Simple key-value substitution for reuse across config. # vars: # NET_IF: eth0 # DMZ_NET: 10.0.0.0/24 # Connection tracking control (replaces /etc/shorewall/conntrack) # Bypass conntrack for high-volume traffic or assign CT helpers. # conntrack: # - action: notrack # source: net # dest: fw # proto: udp # dport: [53] # comment: "Skip conntrack for DNS" # - action: helper # source: loc # dest: net # proto: tcp # dport: [21] # helper: ftp # comment: "FTP conntrack helper" # Blacklist/whitelist rules (replaces /etc/shorewall/blrules) # Processed before normal rules. ACCEPT/WHITELIST exempt from remaining blrules. # blrules: # - action: drop # source: net:192.88.99.1 # dest: all # comment: "Block known bad host" # - action: whitelist # source: net:70.90.191.120/29 # dest: all # comment: "Trusted range" # VPN tunnels (replaces /etc/shorewall/tunnels) # Allows encapsulated traffic to pass; actual tunnel traffic uses normal rules. # tunnels: # - type: ipsec # zone: net # gateways: [4.33.99.124] # - type: openvpn:udp # zone: net # gateways: [0.0.0.0/0] # gateway_zones: [vpn] # port: 1194 # Routing rules (replaces /etc/shorewall/rtrules) # Directs traffic to specific provider routing tables. # rtrules: # - source: eth1 # provider: ISP1 # priority: 1000 # - dest: 10.8.0.0/24 # provider: main # priority: 1000 # comment: "OpenVPN traffic stays in main table" # Stopped rules (replaces /etc/shorewall/stoppedrules) # Traffic permitted when the firewall is stopped. # stoppedrules: # - action: accept # source: eth1 # dest: $FW # comment: "Allow local access when stopped" # - action: accept # source: $FW # dest: eth1 # comment: "Allow firewall to reach LAN when stopped" # Multi-ISP / policy routing (replaces /etc/shorewall/providers) # providers: # - name: ISP1 # number: 1 # mark: 0x10000 # duplicate: main # interface: eth0 # gateway: 206.124.146.254 # options: # track: true # balance: 1 # copy: [eth2] # - name: ISP2 # number: 2 # mark: 0x20000 # duplicate: main # interface: eth3 # gateway: 130.252.99.254 # options: # track: true # balance: 1 # copy: [eth2] # Proxy NDP (replaces /etc/shorewall6/proxyndp) # IPv6 equivalent of Proxy ARP — answers NDP queries on behalf of another host. # proxyndp: # - address: "2001:db8::100" # interface: eth1 # external: eth0 # persistent: true # - address: "fd10::1" # external: eth0 # haveroute: true