Page MenuHomeVyOS Platform

"fib" statement support for firewall and nat configuration
Open, LowPublicFEATURE REQUEST

Description

Can the "fib" nftables statement options be added to VyOS firewall and nat configuration options per:
https://wiki.nftables.org/wiki-nftables/index.php/Matching_routing_information ?


fib:
The fib statement can be used to obtain the output interface from the route table based on either source or destination address of a packet. This can be used to e.g. add reverse path filtering, or eg. drop if not coming from the same interface packet arrived on.

General syntax is: fib key data operator expression, where:

    key: saddr, daddr, mark, iif, oif (use '.' for concatenations to represent tuples)
    data: oif, oifname, (address) type
    operator: eq, neq, vmap, map

It would be useful to have these options available in general firewall and nat configuration nodes in VyOS, for example:

set nat destination rule 100 fib <key> <data> <operator> expression
set firewall name OUTSIDE-IN rule 100 fib <key> <data> <operator> expression

Please refer to provided nftables wiki link for further example usage/syntax.

Thank you!

Details

Difficulty level
Unknown (require assessment)
Version
1.4
Why the issue appeared?
Will be filled on close
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Feature (new functionality)

Related Objects