ansible-roles/vpn/bridge/templates/post-up-br0-ipv4.nft

31 lines
979 B
Plaintext
Raw Normal View History

2022-12-20 19:47:11 +01:00
#!/usr/bin/env -S nft -f
table ip br0_ipv4 {
chain prerouting {
type nat hook prerouting priority -100;
{% for forward in vpn_bridge_dnat %}
iif {{ ansible_default_ipv4.interface }} tcp dport { {{ forward.ports | join(", ") }} } dnat to {{ forward.address }};
{% endfor %}
}
2023-07-08 12:58:07 +02:00
chain forward {
type filter hook forward priority 0;
2022-12-20 19:47:11 +01:00
{% if local_network is defined %}
ct state established,related accept;
iif br0 ip daddr {{ local_network }} drop;
{% endif %}
2023-07-08 12:58:07 +02:00
{% if vpn_bridge_local_only_daddr %}
# Drop all external traffic for these addresses.
ip saddr != {{ vpn_bridge_subnet }} ip daddr { {{ vpn_bridge_local_only_daddr | join(", ") }} } drop;
{% endif %}
}
2022-12-20 19:47:11 +01:00
chain postrouting {
type nat hook postrouting priority 100;
iif br0 oif {{ ansible_default_ipv4.interface }} masquerade;
}
}