Method fw_router_routing

systemvm/debian/opt/cloud/bin/cs/CsAddress.py:683–715

(self)

        self.fw.append(["filter", "", "-P FORWARD DROP"])

    def fw_router_routing(self):
        if self.config.is_vpc() or not self.config.is_routed():
            return

        # Add default rules for INPUT chain
        self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                 'rule': "iifname lo counter accept"})
        self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                 'rule': "iifname eth2 ct state related,established counter accept"})
        # Add default rules for FORWARD chain
        self.nft_ipv4_fw.append({'type': "", 'chain': 'FORWARD',
                   'rule': 'iifname "eth2" oifname "eth0" ct state related,established counter accept'})
        self.nft_ipv4_fw.append({'type': "", 'chain': 'FORWARD',
                   'rule': 'iifname "eth0" oifname "eth0" ct state new counter accept'})
        self.nft_ipv4_fw.append({'type': "", 'chain': 'FORWARD',
                   'rule': 'iifname "eth0" oifname "eth0" ct state related,established counter accept'})

        if self.get_type() in ["guest"]:
            guestNetworkCidr = self.address['network']
            self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                     'rule': "iifname %s ct state related,established counter accept" % self.dev})
            self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                     'rule': "iifname %s udp dport 67 counter accept" % self.dev})
            self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                     'rule': "iifname %s ip saddr %s tcp dport 53 counter accept" % (self.dev, guestNetworkCidr)})
            self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                     'rule': "iifname %s ip saddr %s udp dport 53 counter accept" % (self.dev, guestNetworkCidr)})
            self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                     'rule': "iifname %s ip saddr %s tcp dport 80 ct state new counter accept" % (self.dev, guestNetworkCidr)})
            self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                     'rule': "iifname %s ip saddr %s tcp dport 443 ct state new counter accept" % (self.dev, guestNetworkCidr)})
            self.nft_ipv4_fw.append({'type': "", 'chain': 'INPUT',
                                     'rule': "iifname %s ip saddr %s tcp dport 8080 ct state new counter accept" % (self.dev, guestNetworkCidr)})

    def fw_vpcrouter_routing(self):
        if not self.config.is_vpc() or not self.config.is_routed():