From 672b76f3c277c5b99e156836a6da88fa997668f7 Mon Sep 17 00:00:00 2001 From: Christian Pointner Date: Sat, 22 Apr 2023 16:36:02 +0200 Subject: c3voc: disallow outgoing connections from voc to internal nets --- inventory/host_vars/ch-gw-c3voc.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'inventory/host_vars/ch-gw-c3voc.yml') diff --git a/inventory/host_vars/ch-gw-c3voc.yml b/inventory/host_vars/ch-gw-c3voc.yml index 60d833bf..ec85f56c 100644 --- a/inventory/host_vars/ch-gw-c3voc.yml +++ b/inventory/host_vars/ch-gw-c3voc.yml @@ -77,6 +77,7 @@ openwrt_mixin: flush ruleset define nic_svc = eth1 + define prefixes_internal = { 192.168.0.0/16 } define nic_c3voc = eth0 define prefix_c3voc = {{ network_zones.c3voc.prefix }} @@ -108,7 +109,7 @@ openwrt_mixin: type filter hook forward priority filter; policy drop; ct state vmap { established: accept, related: accept, invalid: drop } iif $nic_svc oif $nic_c3voc ip daddr $prefix_c3voc accept - iif $nic_c3voc ip saddr $prefix_c3voc oifname $nic_svc accept + iif $nic_c3voc ip saddr $prefix_c3voc oifname $nic_svc ip daddr != $prefixes_internal accept } } -- cgit v1.2.3