firewall

Pre-Alpha. This page describes behavior that may change.

Ze includes a firewall subsystem with an nftables backend for stateful packet filtering. Configuration lives in the firewall { } YANG section.

Configuration

firewall {
    backend nft;
    table inet filter {
        chain input {
            type filter;
            hook input;
            priority 0;
            policy drop;
            rule accept-established {
                match { conntrack-state established,related; }
                action accept;
            }
            rule accept-ssh {
                match { protocol tcp; destination-port 22; }
                action accept;
            }
            rule accept-bgp {
                match { protocol tcp; destination-port 179; }
                action accept;
            }
            rule accept-bfd {
                match { protocol udp; destination-port 3784; }
                action accept;
            }
        }
    }
}

The nftables backend lowers the YANG config into nftables expressions at commit time.

Backend gate

The ze:backend YANG extension provides commit-time rejection of unsupported features. If a feature is not supported by the configured backend, the commit fails with a descriptive error rather than silently ignoring the rule.

CLI commands

Command	Description
show firewall	Current firewall state and rule counts.
show ip firewall	IP-level firewall state.
clear firewall counters	Reset match counters.

See also

• Traffic Control for per-interface queueing disciplines.
• Plugins for the plugin list.
• In-tree features for the authoritative capability list.