unkinben
8d9a76c751
Rewrites the compiler from ~440 to ~1700 lines covering all major shorewall firewall features: loopback, conntrack fast-path, anti-spoof, DHCP, intra-zone, blacklist/whitelist, conntrack notrack, tunnels (13 types), rules with sections, DNAT/redirect, SNAT/masquerade, static NAT, policies with zone exclusions, MSS clamping, rate limiting, connection limiting, negated addresses, ICMP type matching, TCP RST reject, user/UID matching, mark match/set, NFQUEUE, NONAT, and policy-level rate/conn limiting. Adds full config types for all shorewall subsystems (mangle, accounting, maclist, netmap, providers, tunnels, conntrack, blrules, proxyarp/ndp, routes, tc, secmarks), shorewall migration tooling, expanded CLI commands, expression-level diff engine, and 49 unit tests.
286 lines
6.3 KiB
YAML
286 lines
6.3 KiB
YAML
# tomswall configuration
|
|
# Spiritual successor to shorewall — manages nftables directly
|
|
|
|
settings:
|
|
# address_family: inet (default), ip (IPv4 only), ip6 (IPv6 only)
|
|
address_family: inet
|
|
ip_forwarding: true
|
|
log_level: info
|
|
table_name: tomswall
|
|
implicit_continue: false
|
|
|
|
# Named port groups — reusable port+protocol combos referenced in rules
|
|
portgroups:
|
|
web:
|
|
proto: tcp
|
|
ports: [80, 443]
|
|
dns_udp:
|
|
proto: udp
|
|
ports: [53]
|
|
dns_tcp:
|
|
proto: tcp
|
|
ports: [53]
|
|
ssh:
|
|
proto: tcp
|
|
ports: [22]
|
|
mail:
|
|
proto: tcp
|
|
ports: [25, 465, 587, 993, 995]
|
|
high_ports:
|
|
proto: tcp
|
|
ports: ["1024-65535"]
|
|
|
|
# Security zones (replaces /etc/shorewall/zones)
|
|
# Child zones are listed before parents; nesting via parents field.
|
|
zones:
|
|
fw:
|
|
type: firewall
|
|
net:
|
|
type: ip
|
|
loc:
|
|
type: ip
|
|
dmz:
|
|
type: ip
|
|
# Example nested zone: sam is a sub-zone of net
|
|
# sam:
|
|
# type: ip
|
|
# parents: [net]
|
|
|
|
# Interface-to-zone mappings (replaces /etc/shorewall/interfaces)
|
|
interfaces:
|
|
- zone: net
|
|
interface: eth0
|
|
options:
|
|
dhcp: true
|
|
nosmurfs: true
|
|
routefilter: 1
|
|
logmartians: true
|
|
- zone: loc
|
|
interface: eth1
|
|
options:
|
|
mss: 1400
|
|
- zone: dmz
|
|
interface: eth2
|
|
|
|
# Host definitions (replaces /etc/shorewall/hosts)
|
|
# Only needed when multiple zones share an interface.
|
|
hosts:
|
|
- zone: loc
|
|
interface: eth1
|
|
addresses:
|
|
- 192.168.1.0/24
|
|
|
|
# Default zone-to-zone policies (replaces /etc/shorewall/policy)
|
|
# Evaluated in order; first match wins.
|
|
# Intra-zone traffic is implicitly ACCEPTed unless overridden with all+.
|
|
policy:
|
|
- source: fw
|
|
dest: all
|
|
action: accept
|
|
- source: loc
|
|
dest: net
|
|
action: accept
|
|
- source: loc
|
|
dest: fw
|
|
action: accept
|
|
- source: net
|
|
dest: all
|
|
action: drop
|
|
log: info
|
|
- source: all
|
|
dest: all
|
|
action: reject
|
|
log: info
|
|
|
|
# Specific traffic rules (replaces /etc/shorewall/rules)
|
|
rules:
|
|
- action: accept
|
|
source: loc
|
|
dest: fw
|
|
portgroup: ssh
|
|
|
|
- action: accept
|
|
source: loc
|
|
dest: net
|
|
portgroup: dns_udp
|
|
- action: accept
|
|
source: loc
|
|
dest: net
|
|
portgroup: dns_tcp
|
|
|
|
- action: accept
|
|
source: net
|
|
dest: dmz
|
|
portgroup: web
|
|
|
|
- action: accept
|
|
source: loc
|
|
dest: fw
|
|
proto: icmp
|
|
|
|
- action: drop
|
|
source: net
|
|
dest: all
|
|
proto: icmp
|
|
|
|
# DNAT: forward port 2222 from net to loc host on port 22
|
|
# - action: dnat
|
|
# source: net
|
|
# dest: loc:192.168.1.3:22
|
|
# proto: tcp
|
|
# dport: [2222]
|
|
|
|
# Time-restricted rule example
|
|
# - action: accept
|
|
# source: loc
|
|
# dest: net
|
|
# portgroup: web
|
|
# time:
|
|
# weekdays: [Mon, Tue, Wed, Thu, Fri]
|
|
# start: "08:00"
|
|
# stop: "18:00"
|
|
|
|
# Source NAT rules (replaces /etc/shorewall/snat)
|
|
# First match wins.
|
|
snat:
|
|
- action: masquerade
|
|
source: 192.168.1.0/24
|
|
dest: eth0
|
|
|
|
# Load-balanced SNAT across multiple addresses
|
|
# - action: snat
|
|
# address: 1.1.1.1
|
|
# source: 192.168.1.0/24
|
|
# dest: eth0
|
|
# probability: 0.5
|
|
# - action: snat
|
|
# address: 1.1.1.2
|
|
# source: 192.168.1.0/24
|
|
# dest: eth0
|
|
|
|
# One-to-one static NAT (replaces /etc/shorewall/nat)
|
|
# Maps an external IP to an internal IP bidirectionally.
|
|
# DNAT rules take precedence over static NAT.
|
|
# nat:
|
|
# - external: 203.0.113.10
|
|
# interface: eth0
|
|
# internal: 192.168.1.10
|
|
# all_interfaces: false
|
|
# local: true
|
|
|
|
# Network-to-network address mapping (replaces /etc/shorewall/netmap)
|
|
# Maps one subnet to another at the IP header level.
|
|
# netmap:
|
|
# - type: dnat
|
|
# net1: 10.0.0.0/24
|
|
# interface: eth0
|
|
# net2: 192.168.1.0/24
|
|
# - type: snat
|
|
# net1: 192.168.1.0/24
|
|
# interface: eth0
|
|
# net2: 10.0.0.0/24
|
|
|
|
# Variables (replaces /etc/shorewall/params)
|
|
# Simple key-value substitution for reuse across config.
|
|
# vars:
|
|
# NET_IF: eth0
|
|
# DMZ_NET: 10.0.0.0/24
|
|
|
|
# Connection tracking control (replaces /etc/shorewall/conntrack)
|
|
# Bypass conntrack for high-volume traffic or assign CT helpers.
|
|
# conntrack:
|
|
# - action: notrack
|
|
# source: net
|
|
# dest: fw
|
|
# proto: udp
|
|
# dport: [53]
|
|
# comment: "Skip conntrack for DNS"
|
|
# - action: helper
|
|
# source: loc
|
|
# dest: net
|
|
# proto: tcp
|
|
# dport: [21]
|
|
# helper: ftp
|
|
# comment: "FTP conntrack helper"
|
|
|
|
# Blacklist/whitelist rules (replaces /etc/shorewall/blrules)
|
|
# Processed before normal rules. ACCEPT/WHITELIST exempt from remaining blrules.
|
|
# blrules:
|
|
# - action: drop
|
|
# source: net:192.88.99.1
|
|
# dest: all
|
|
# comment: "Block known bad host"
|
|
# - action: whitelist
|
|
# source: net:70.90.191.120/29
|
|
# dest: all
|
|
# comment: "Trusted range"
|
|
|
|
# VPN tunnels (replaces /etc/shorewall/tunnels)
|
|
# Allows encapsulated traffic to pass; actual tunnel traffic uses normal rules.
|
|
# tunnels:
|
|
# - type: ipsec
|
|
# zone: net
|
|
# gateways: [4.33.99.124]
|
|
# - type: openvpn:udp
|
|
# zone: net
|
|
# gateways: [0.0.0.0/0]
|
|
# gateway_zones: [vpn]
|
|
# port: 1194
|
|
|
|
# Routing rules (replaces /etc/shorewall/rtrules)
|
|
# Directs traffic to specific provider routing tables.
|
|
# rtrules:
|
|
# - source: eth1
|
|
# provider: ISP1
|
|
# priority: 1000
|
|
# - dest: 10.8.0.0/24
|
|
# provider: main
|
|
# priority: 1000
|
|
# comment: "OpenVPN traffic stays in main table"
|
|
|
|
# Stopped rules (replaces /etc/shorewall/stoppedrules)
|
|
# Traffic permitted when the firewall is stopped.
|
|
# stoppedrules:
|
|
# - action: accept
|
|
# source: eth1
|
|
# dest: $FW
|
|
# comment: "Allow local access when stopped"
|
|
# - action: accept
|
|
# source: $FW
|
|
# dest: eth1
|
|
# comment: "Allow firewall to reach LAN when stopped"
|
|
|
|
# Multi-ISP / policy routing (replaces /etc/shorewall/providers)
|
|
# providers:
|
|
# - name: ISP1
|
|
# number: 1
|
|
# mark: 0x10000
|
|
# duplicate: main
|
|
# interface: eth0
|
|
# gateway: 206.124.146.254
|
|
# options:
|
|
# track: true
|
|
# balance: 1
|
|
# copy: [eth2]
|
|
# - name: ISP2
|
|
# number: 2
|
|
# mark: 0x20000
|
|
# duplicate: main
|
|
# interface: eth3
|
|
# gateway: 130.252.99.254
|
|
# options:
|
|
# track: true
|
|
# balance: 1
|
|
# copy: [eth2]
|
|
|
|
# Proxy NDP (replaces /etc/shorewall6/proxyndp)
|
|
# IPv6 equivalent of Proxy ARP — answers NDP queries on behalf of another host.
|
|
# proxyndp:
|
|
# - address: "2001:db8::100"
|
|
# interface: eth1
|
|
# external: eth0
|
|
# persistent: true
|
|
# - address: "fd10::1"
|
|
# external: eth0
|
|
# haveroute: true
|