|
@ -1,35 +1,35 @@ |
|
|
table inet lxd { |
|
|
table inet lxd { |
|
|
chain pstrt.lxdbr0 { |
|
|
|
|
|
type nat hook postrouting priority srcnat; policy accept; |
|
|
|
|
|
|
|
|
chain pstrt.lxdbr0 { |
|
|
|
|
|
type nat hook postrouting priority srcnat; policy accept; |
|
|
|
|
|
|
|
|
{%- if target != 'prod' %} |
|
|
|
|
|
# BLOCK SMTP PORTS |
|
|
|
|
|
tcp dport { 25, 465, 587 } ip saddr {{ firewall.bridge_subnet }} {%- if firewall.container_mail_passthrough %} ip saddr |
|
|
|
|
|
!= {{ env.ip_mail_passthrough }} {% endif %} log prefix "Drop SMTP away from container: " drop |
|
|
|
|
|
{% endif -%} |
|
|
|
|
|
|
|
|
{%- if target != 'prod' %} |
|
|
|
|
|
# BLOCK SMTP PORTS |
|
|
|
|
|
tcp dport { 25, 465, 587 } ip saddr {{ firewall.bridge_subnet }} {%- if firewall.container_mail_passthrough %} ip saddr |
|
|
|
|
|
!= {{ env.ip_mail_passthrough }} {% endif %} log prefix "Drop SMTP away from container: " drop |
|
|
|
|
|
{% endif -%} |
|
|
|
|
|
|
|
|
ip saddr {{ firewall.bridge_subnet }} ip daddr != {{ firewall.bridge_subnet }} masquerade |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
ip saddr {{ firewall.bridge_subnet }} ip daddr != {{ firewall.bridge_subnet }} masquerade |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
chain fwd.lxdbr0 { |
|
|
|
|
|
type filter hook forward priority filter; policy accept; |
|
|
|
|
|
ip version 4 oifname "lxdbr0" accept |
|
|
|
|
|
ip version 4 iifname "lxdbr0" accept |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
chain fwd.lxdbr0 { |
|
|
|
|
|
type filter hook forward priority filter; policy accept; |
|
|
|
|
|
ip version 4 oifname "lxdbr0" accept |
|
|
|
|
|
ip version 4 iifname "lxdbr0" accept |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
chain in.lxdbr0 { |
|
|
|
|
|
type filter hook input priority filter; policy accept; |
|
|
|
|
|
iifname "lxdbr0" tcp dport 53 accept |
|
|
|
|
|
iifname "lxdbr0" udp dport 53 accept |
|
|
|
|
|
iifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept |
|
|
|
|
|
iifname "lxdbr0" udp dport 67 accept |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
chain in.lxdbr0 { |
|
|
|
|
|
type filter hook input priority filter; policy accept; |
|
|
|
|
|
iifname "lxdbr0" tcp dport 53 accept |
|
|
|
|
|
iifname "lxdbr0" udp dport 53 accept |
|
|
|
|
|
iifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept |
|
|
|
|
|
iifname "lxdbr0" udp dport 67 accept |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
chain out.lxdbr0 { |
|
|
|
|
|
type filter hook output priority filter; policy accept; |
|
|
|
|
|
oifname "lxdbr0" tcp sport 53 accept |
|
|
|
|
|
oifname "lxdbr0" udp sport 53 accept |
|
|
|
|
|
oifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept |
|
|
|
|
|
oifname "lxdbr0" udp sport 67 accept |
|
|
|
|
|
} |
|
|
|
|
|
|
|
|
chain out.lxdbr0 { |
|
|
|
|
|
type filter hook output priority filter; policy accept; |
|
|
|
|
|
oifname "lxdbr0" tcp sport 53 accept |
|
|
|
|
|
oifname "lxdbr0" udp sport 53 accept |
|
|
|
|
|
oifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept |
|
|
|
|
|
oifname "lxdbr0" udp sport 67 accept |
|
|
|
|
|
} |
|
|
} |
|
|
} |