unkinben
2a3eb3b04d
Spiritual successor to shorewall — manages nftables directly via google/nftables. Reads a single YAML config covering zones, interfaces, hosts, policy, rules, snat, and named portgroups. Computes differential changes against the running nftables state and applies them atomically. Supports detecting and purging rules added outside of tomswall.
124 lines
2.3 KiB
YAML
124 lines
2.3 KiB
YAML
# tomswall configuration
|
|
# Spiritual successor to shorewall — manages nftables directly
|
|
|
|
settings:
|
|
ip_forwarding: true
|
|
log_level: info
|
|
table_name: tomswall
|
|
|
|
# Named port groups — reusable port+protocol combos referenced in rules
|
|
portgroups:
|
|
web:
|
|
proto: tcp
|
|
ports: [80, 443]
|
|
dns_udp:
|
|
proto: udp
|
|
ports: [53]
|
|
dns_tcp:
|
|
proto: tcp
|
|
ports: [53]
|
|
ssh:
|
|
proto: tcp
|
|
ports: [22]
|
|
mail:
|
|
proto: tcp
|
|
ports: [25, 465, 587, 993, 995]
|
|
high_ports:
|
|
proto: tcp
|
|
ports: ["1024-65535"]
|
|
|
|
# Security zones (replaces /etc/shorewall/zones)
|
|
zones:
|
|
fw:
|
|
type: firewall
|
|
net:
|
|
type: ip
|
|
loc:
|
|
type: ip
|
|
dmz:
|
|
type: ip
|
|
|
|
# Interface-to-zone mappings (replaces /etc/shorewall/interfaces)
|
|
interfaces:
|
|
- zone: net
|
|
interface: eth0
|
|
options:
|
|
dhcp: true
|
|
tcpflags: true
|
|
nosmurfs: true
|
|
- zone: loc
|
|
interface: eth1
|
|
- zone: dmz
|
|
interface: eth2
|
|
|
|
# Host definitions (replaces /etc/shorewall/hosts)
|
|
hosts:
|
|
- zone: loc
|
|
interface: eth1
|
|
addresses:
|
|
- 192.168.1.0/24
|
|
|
|
# Default zone-to-zone policies (replaces /etc/shorewall/policy)
|
|
# Evaluated in order after specific rules; first match wins
|
|
policy:
|
|
- source: fw
|
|
dest: all
|
|
action: accept
|
|
- source: loc
|
|
dest: net
|
|
action: accept
|
|
- source: loc
|
|
dest: fw
|
|
action: accept
|
|
- source: net
|
|
dest: all
|
|
action: drop
|
|
log: info
|
|
- source: all
|
|
dest: all
|
|
action: reject
|
|
log: info
|
|
|
|
# Specific traffic rules (replaces /etc/shorewall/rules)
|
|
# Supports zone:address notation, e.g. source: "net:203.0.113.0/24"
|
|
rules:
|
|
# Allow SSH from local network to firewall
|
|
- action: accept
|
|
source: loc
|
|
dest: fw
|
|
portgroup: ssh
|
|
|
|
# Allow DNS from local network
|
|
- action: accept
|
|
source: loc
|
|
dest: net
|
|
portgroup: dns_udp
|
|
- action: accept
|
|
source: loc
|
|
dest: net
|
|
portgroup: dns_tcp
|
|
|
|
# Allow web traffic from net to DMZ
|
|
- action: accept
|
|
source: net
|
|
dest: dmz
|
|
portgroup: web
|
|
|
|
# Allow ping from local network
|
|
- action: accept
|
|
source: loc
|
|
dest: fw
|
|
proto: icmp
|
|
|
|
# Drop all other ICMP from net
|
|
- action: drop
|
|
source: net
|
|
dest: all
|
|
proto: icmp
|
|
|
|
# Source NAT rules (replaces /etc/shorewall/snat)
|
|
snat:
|
|
- action: masquerade
|
|
source: 192.168.1.0/24
|
|
dest_interface: eth0
|