More generic interface list in nftables

This commit is contained in:
Wojciech Kozlowski 2023-04-08 09:43:55 +02:00
parent e91babde35
commit 29d2e3b9c4
2 changed files with 5 additions and 2 deletions

View File

@ -1,3 +1,4 @@
---
system_base_interfaces_iifname: []
system_base_additional_tcp_ports: []
system_base_udp_ports: []

View File

@ -10,9 +10,11 @@ table inet filter {
# Accept any localhost traffic.
iif lo accept;
# Accept any libvirt traffic.
iifname virbr0 accept;
{% if system_base_interfaces_iifname %}
# Accept any traffic on these interfaces.
iifname { {{ system_base_interfaces_iifname | join(", ") }} } accept;
{% endif %}
# Accept traffic originated from us.
ct state established,related accept;