chain input {
type filter hook input priority filter; policy {{ fw4.input_policy(true) }};
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
{% fw4.includes('chain-prepend', 'input') %}
ct state vmap { established : accept, related : accept{% if (fw4.default_option("drop_invalid")): %}, invalid : drop{% endif %} } comment "!fw4: Handle inbound flows"
chain output {
type filter hook output priority filter; policy {{ fw4.output_policy(true) }};
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
{% fw4.includes('chain-prepend', 'output') %}
ct state vmap { established : accept, related : accept{% if (fw4.default_option("drop_invalid")): %}, invalid : drop{% endif %} } comment "!fw4: Handle outbound flows"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
chain output {
type filter hook output priority filter; policy accept;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
meta l4proto tcp counter comment "!fw4: Test-Deprecated-Rule-Option"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
meta nfproto ipv6 ip6 saddr & ::ffff == ::1 ip6 saddr & ::ffff != ::2 jump input_test1 comment "!fw4: Handle test1 IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
meta nfproto ipv6 ip6 daddr & ::ffff == ::1 ip6 daddr & ::ffff != ::2 jump output_test1 comment "!fw4: Handle test1 IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
meta nfproto ipv4 ip saddr 10.0.0.0/8 jump input_test1 comment "!fw4: Handle test1 IPv4 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
meta nfproto ipv4 ip daddr 10.0.0.0/8 jump output_test1 comment "!fw4: Handle test1 IPv4 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "zone1" jump input_test1 comment "!fw4: Handle test1 IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "zone1" jump output_test1 comment "!fw4: Handle test1 IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
counter comment "!fw4: @rule[1]"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
counter comment "!fw4: @rule[0]"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
}
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
counter comment "!fw4: Implicitly enabled"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
}
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
meta nfproto ipv4 ip dscp 0x0 counter comment "!fw4: DSCP match rule #1"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
}
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
meta l4proto { "icmp", "ipv6-icmp" } counter comment "!fw4: ICMP rule #1"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname { "eth0", "eth1" } jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname { "eth0", "eth1" } jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
ip6 saddr & ::ffff == ::1 ip6 daddr & ::ffff != ::2 counter comment "!fw4: Mask rule #1"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
meta nfproto ipv4 ip saddr 192.168.1.0/24 jump input_ipv4only comment "!fw4: Handle ipv4only IPv4 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
meta nfproto ipv4 ip daddr 192.168.1.0/24 jump output_ipv4only comment "!fw4: Handle ipv4only IPv4 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
}
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
meta time >= "2022-05-30 21:51:23" counter accept comment "!fw4: Time rule #1"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "eth0" jump input_zone1 comment "!fw4: Handle zone1 IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "eth0" jump output_zone1 comment "!fw4: Handle zone1 IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
}
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
counter log prefix "@rule[0]: " comment "!fw4: @rule[0]"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
}
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
}
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "eth0" jump input_wanA comment "!fw4: Handle wanA IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "eth0" jump output_wanA comment "!fw4: Handle wanA IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
}
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
}
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
}
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
}
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic"
chain input {
type filter hook input priority filter; policy drop;
- iifname "lo" accept comment "!fw4: Accept traffic from loopback"
+ iif "lo" accept comment "!fw4: Accept traffic from loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
iifname "eth0" jump input_test comment "!fw4: Handle test IPv4/IPv6 input traffic"
chain output {
type filter hook output priority filter; policy drop;
- oifname "lo" accept comment "!fw4: Accept traffic towards loopback"
+ oif "lo" accept comment "!fw4: Accept traffic towards loopback"
ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
oifname "eth0" jump output_test comment "!fw4: Handle test IPv4/IPv6 output traffic"