firewall4/tests/03_rules/07_redirect

Test various address selection rules in redirect rules.

-- Testcase --
{%
	include("./root/usr/share/firewall4/main.uc", {
		getenv: function(varname) {
			switch (varname) {
			case 'ACTION':
				return 'print';
			}
		}
	})
%}
-- End --

-- File uci/helpers.json --
{}
-- End --

-- File uci/firewall.json --
{
	"zone": [
		{
			"name": "wan",
			"network": [ "wan", "wan6" ],
			"masq": 1,
			"masq6": 1
		},
		{
			"name": "lan",
			"network": "lan",
			"auto_helper": 0
		},
		{
			"name": "noaddr",
			"network": [ "noaddr" ],
			"masq": 1,
			"masq6": 1
		}
	],
	"redirect": [
		{
			".description": "Ensure unspecified family with no src, dest or rewrite address is treated as IPv4 only",
			"name": "Redirect test #1",
			"src": "lan",
			"dest": "wan",
			"proto": "udp",
			"src_dport": "53",
			"dest_port": "53",
			"target": "dnat"
		},
		{
			".description": "Ensure that explicit family any with no src, dest or rewrite address is treated as IPv4/IPv6",
			"name": "Redirect test #2",
			"family": "any",
			"src": "lan",
			"dest": "wan",
			"proto": "udp",
			"src_dport": "53",
			"dest_port": "53",
			"target": "dnat"
		},
		{
			".description": "Ensure that a DNAT without explicit dest zone infers the zone from the rewrite address",
			"name": "Redirect test #3",
			"src": "wan",
			"proto": "tcp",
			"src_dport": "22",
			"dest_ip": "192.168.26.100"
		},
		{
			".description": "Ensure that external reflection source uses the src zone addr as reflection source IP",
			"name": "Redirect test #4",
			"src": "wan",
			"proto": "tcp",
			"src_dport": "23",
			"dest_ip": "192.168.26.100",
			"reflection_src": "external"
		},
		{
			".description": "Ensure that reflection is disabled if external address cannot be determined",
			"name": "Redirect test #5",
			"src": "noaddr",
			"dest": "lan",
			"proto": "tcp",
			"src_dport": "24",
			"dest_ip": "192.168.26.100"
		},
		{
			".description": "Ensure that the rewrite IPv6 address is using bracket notation when a port is specified",
			"name": "Redirect test #6",
			"family": "ipv6",
			"src": "wan",
			"dest": "lan",
			"proto": "tcp",
			"src_dport": "25",
			"dest_ip": "2001:db8:1000:1::1234",
			"dest_port": "25",
			"target": "dnat"
		},
		{
			".description": "Ensure that family restricted redirect rules work properly",
			"name": "Redirect test #7",
			"family": "ipv4",
			"src": "wan",
			"dest": "lan",
			"proto": "tcp",
			"src_dport": "26",
			"dest_port": "26",
			"target": "dnat"
		},
		{
			".description": "Ensure that family restricted redirect rules work properly",
			"name": "Redirect test #8",
			"family": "ipv6",
			"src": "wan",
			"dest": "lan",
			"proto": "tcp",
			"src_dport": "27",
			"dest_port": "27",
			"target": "dnat"
		}
	]
}
-- End --

-- Expect stderr --
[!] Section @redirect[2] (Redirect test #3) does not specify a destination, assuming 'lan'
[!] Section @redirect[3] (Redirect test #4) does not specify a destination, assuming 'lan'
[!] Section @redirect[4] (Redirect test #5) external address range cannot be determined, disabling reflection
-- End --

-- Expect stdout --
table inet fw4
flush table inet fw4

table inet fw4 {
	#
	# Defines
	#

	define wan_devices = { "pppoe-wan" }
	define wan_subnets = { 10.11.12.0/24, 2001:db8:54:321::/64 }

	define lan_devices = { "br-lan" }
	define lan_subnets = { 10.0.0.0/24, 192.168.26.0/24, 2001:db8:1000::/60, fd63:e2f:f706::/60 }

	define noaddr_devices = { "wwan0" }
	define noaddr_subnets = {  }


	#
	# User includes
	#

	include "/etc/nftables.d/*.nft"


	#
	# Filter rules
	#

	chain input {
		type filter hook input priority filter; policy drop;

		iif "lo" accept comment "!fw4: Accept traffic from loopback"

		ct state vmap { established : accept, related : accept } comment "!fw4: Handle inbound flows"
		iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
		iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
		iifname "wwan0" jump input_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 input traffic"
	}

	chain forward {
		type filter hook forward priority filter; policy drop;

		ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
		iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
		iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
		iifname "wwan0" jump forward_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 forward traffic"
	}

	chain output {
		type filter hook output priority filter; policy drop;

		oif "lo" accept comment "!fw4: Accept traffic towards loopback"

		ct state vmap { established : accept, related : accept } comment "!fw4: Handle outbound flows"
		oifname "pppoe-wan" jump output_wan comment "!fw4: Handle wan IPv4/IPv6 output traffic"
		oifname "br-lan" jump output_lan comment "!fw4: Handle lan IPv4/IPv6 output traffic"
		oifname "wwan0" jump output_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 output traffic"
	}

	chain prerouting {
		type filter hook prerouting priority filter; policy accept;
	}

	chain handle_reject {
		meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
		reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
	}

	chain input_wan {
		ct status dnat accept comment "!fw4: Accept port redirections"
		jump drop_from_wan
	}

	chain output_wan {
		jump drop_to_wan
	}

	chain forward_wan {
		ct status dnat accept comment "!fw4: Accept port forwards"
		jump drop_to_wan
	}

	chain drop_from_wan {
		iifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
	}

	chain drop_to_wan {
		oifname "pppoe-wan" counter drop comment "!fw4: drop wan IPv4/IPv6 traffic"
	}

	chain input_lan {
		ct status dnat accept comment "!fw4: Accept port redirections"
		jump drop_from_lan
	}

	chain output_lan {
		jump drop_to_lan
	}

	chain forward_lan {
		ct status dnat accept comment "!fw4: Accept port forwards"
		jump drop_to_lan
	}

	chain accept_to_lan {
		oifname "br-lan" counter accept comment "!fw4: accept lan IPv4/IPv6 traffic"
	}

	chain drop_from_lan {
		iifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
	}

	chain drop_to_lan {
		oifname "br-lan" counter drop comment "!fw4: drop lan IPv4/IPv6 traffic"
	}

	chain input_noaddr {
		ct status dnat accept comment "!fw4: Accept port redirections"
		jump drop_from_noaddr
	}

	chain output_noaddr {
		jump drop_to_noaddr
	}

	chain forward_noaddr {
		ct status dnat accept comment "!fw4: Accept port forwards"
		jump drop_to_noaddr
	}

	chain drop_from_noaddr {
		iifname "wwan0" counter drop comment "!fw4: drop noaddr IPv4/IPv6 traffic"
	}

	chain drop_to_noaddr {
		oifname "wwan0" counter drop comment "!fw4: drop noaddr IPv4/IPv6 traffic"
	}


	#
	# NAT rules
	#

	chain dstnat {
		type nat hook prerouting priority dstnat; policy accept;
		iifname "pppoe-wan" jump dstnat_wan comment "!fw4: Handle wan IPv4/IPv6 dstnat traffic"
		iifname "br-lan" jump dstnat_lan comment "!fw4: Handle lan IPv4/IPv6 dstnat traffic"
		iifname "wwan0" jump dstnat_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 dstnat traffic"
	}

	chain srcnat {
		type nat hook postrouting priority srcnat; policy accept;
		oifname "pppoe-wan" jump srcnat_wan comment "!fw4: Handle wan IPv4/IPv6 srcnat traffic"
		oifname "br-lan" jump srcnat_lan comment "!fw4: Handle lan IPv4/IPv6 srcnat traffic"
		oifname "wwan0" jump srcnat_noaddr comment "!fw4: Handle noaddr IPv4/IPv6 srcnat traffic"
	}

	chain dstnat_wan {
		meta nfproto ipv4 tcp dport 22 counter dnat 192.168.26.100:22 comment "!fw4: Redirect test #3"
		meta nfproto ipv4 tcp dport 23 counter dnat 192.168.26.100:23 comment "!fw4: Redirect test #4"
		meta nfproto ipv6 tcp dport 25 counter dnat [2001:db8:1000:1::1234]:25 comment "!fw4: Redirect test #6"
		meta nfproto ipv4 tcp dport 26 counter redirect to 26 comment "!fw4: Redirect test #7"
		meta nfproto ipv6 tcp dport 27 counter redirect to 27 comment "!fw4: Redirect test #8"
	}

	chain srcnat_wan {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 wan traffic"
		meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 wan traffic"
	}

	chain dstnat_lan {
		meta nfproto ipv4 udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #1"
		udp dport 53 counter redirect to 53 comment "!fw4: Redirect test #2"
		ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 22 dnat 192.168.26.100:22 comment "!fw4: Redirect test #3 (reflection)"
		ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 10.11.12.194 tcp dport 23 dnat 192.168.26.100:23 comment "!fw4: Redirect test #4 (reflection)"
		ip6 saddr { 2001:db8:1000::/60, fd63:e2f:f706::/60 } ip6 daddr 2001:db8:54:321::2 tcp dport 25 dnat [2001:db8:1000:1::1234]:25 comment "!fw4: Redirect test #6 (reflection)"
	}

	chain srcnat_lan {
		ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 22 snat 192.168.26.1 comment "!fw4: Redirect test #3 (reflection)"
		ip saddr { 10.0.0.0/24, 192.168.26.0/24 } ip daddr 192.168.26.100 tcp dport 23 snat 10.11.12.194 comment "!fw4: Redirect test #4 (reflection)"
		ip6 saddr { 2001:db8:1000::/60, fd63:e2f:f706::/60 } ip6 daddr 2001:db8:1000:1::1234 tcp dport 25 snat 2001:db8:1000:1::1 comment "!fw4: Redirect test #6 (reflection)"
	}

	chain dstnat_noaddr {
		meta nfproto ipv4 tcp dport 24 counter dnat 192.168.26.100:24 comment "!fw4: Redirect test #5"
	}

	chain srcnat_noaddr {
		meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 noaddr traffic"
		meta nfproto ipv6 masquerade comment "!fw4: Masquerade IPv6 noaddr traffic"
	}


	#
	# Raw rules (notrack)
	#

	chain raw_prerouting {
		type filter hook prerouting priority raw; policy accept;
	}

	chain raw_output {
		type filter hook output priority raw; policy accept;
	}


	#
	# Mangle rules
	#

	chain mangle_prerouting {
		type filter hook prerouting priority mangle; policy accept;
	}

	chain mangle_postrouting {
		type filter hook postrouting priority mangle; policy accept;
	}

	chain mangle_input {
		type filter hook input priority mangle; policy accept;
	}

	chain mangle_output {
		type route hook output priority mangle; policy accept;
	}

	chain mangle_forward {
		type filter hook forward priority mangle; policy accept;
	}
}
-- End --