firewall

Pre-Alpha. This page describes behavior that may change.

Ze manages nftables packet filter and NAT rules from a single firewall { } YANG section. The abstract data model describes matches (from) and actions (then); the backend lowers them to kernel expressions.

Backend

Backend	Platform	Mechanism
nft	Linux	google/nftables netlink library
vpp	Linux + VPP	GoVPP ACL classify pipeline

firewall {
    backend nft;
}

The ze:backend YANG extension provides commit-time rejection of unsupported features. If a feature is not supported by the configured backend, the commit fails with a descriptive error.

Tables and chains

Ze owns all tables whose kernel name starts with ze_. A table contains one or more chains; a base chain has a type, hook, priority, and default policy.

firewall {
    backend nft;
    table wan {
        family inet;
        chain input {
            type filter;
            hook input;
            priority 0;
            policy drop;
            term allow-ssh {
                from {
                    destination-port 22;
                    protocol tcp;
                }
                then {
                    accept;
                }
            }
            term allow-established {
                from {
                    connection-state established,related;
                }
                then {
                    accept;
                }
            }
        }
    }
}

Table families

inet (dual-stack), ip, ip6, arp, bridge, netdev.

Chain types

filter, nat, route.

Hooks

input, output, forward, prerouting, postrouting, ingress, egress.

Match types

Config key	Match	Example
source-address	IP prefix	source-address 10.0.0.0/8;
destination-address	IP prefix	destination-address 192.168.1.0/24;
source-port	Port or range	source-port 1024-65535;
destination-port	Port, range, or list	destination-port 80,443;
protocol	L4 protocol	protocol tcp;
input-interface	Interface name	input-interface eth0;
output-interface	Interface name	output-interface "l2tp*";
icmp-type	ICMP type (name or number)	icmp-type echo-request;
icmpv6-type	ICMPv6 type	icmpv6-type nd-neighbor-solicit;
connection-state	Conntrack states	connection-state established,related;
connection-mark	Mark value/mask	connection-mark 0x10/0xff;
mark	Packet mark value/mask	mark 0x10/0xff;
dscp	DSCP value	dscp ef;
tcp-flags	TCP header flags	tcp-flags syn;
match-set	Named set lookup	match-set blocked source-address;

A trailing * on an interface name produces a prefix match ("l2tp*" matches l2tp0, l2tp1, etc.).

Action types

Config key	Action	Example
accept	Accept packet	accept;
drop	Drop packet	drop;
reject	Reject with ICMP	reject { with icmp; code 3; }
jump / goto	Chain transfer	jump helper;
return	Return from chain	return;
snat	Source NAT	snat { to "10.0.0.1"; }
dnat	Destination NAT	dnat { to "10.1.1.1:8080"; }
masquerade	Masquerade	masquerade; or masquerade { port-start 1024; port-end 65535; random; }
redirect	Redirect to port	redirect { port 8080; }
notrack	Disable conntrack	notrack;
flow-offload	Hardware offload	flow-offload ft0;
mark	Set packet mark	mark { value 0x10; }
connection-mark	Set connmark	connection-mark { value 0x20; mask 0xff; }
dscp	Set DSCP	dscp { value 46; }
tcp-mss	Clamp TCP MSS	tcp-mss { size 1400; }
counter	Count packets/bytes	counter my-counter;
log	Log packet	log { prefix "DROPPED"; }
limit	Rate limit	limit { rate 10/second; burst 5; }
exclude	Skip NAT (Return)	exclude;

NAT

SNAT, DNAT, masquerade, and redirect are available in nat chains. exclude emits a Return verdict so matched traffic skips NAT translation. SNAT and DNAT accept address ranges for pool-based NAT: snat { to "10.0.0.1-10.0.0.10"; }.

VPP backend

When backend vpp is configured and VPP is running, the firewall uses VPP's ACL classify pipeline instead of nftables:

• NAT44-ED: SNAT, DNAT, and masquerade via VPP's NAT44-ED plugin.
• ACL classify: SetMark and Limit actions through VPP classify tables.
• Hardened: patterns discovered in VyOS VPP integration are handled defensively.

The VPP backend supports the same YANG config surface. Features not yet supported by VPP are rejected at commit time via the backend gate.

Named sets

firewall {
    backend nft;
    table wan {
        family inet;
        set blocked {
            type ipv4_addr;
            element 10.0.0.1;
            element 10.0.0.2 { timeout 3600; }
        }
        chain input {
            type filter;
            hook input;
            priority 0;
            policy drop;
            term block-list {
                from {
                    match-set blocked source-address;
                }
                then {
                    drop;
                }
            }
        }
    }
}

Set elements support optional per-element timeouts for dynamic blocklists.

Global options

The global-options container provides sysctl convenience mappings for common firewall-related kernel tunables, so you do not need to duplicate them in the sysctl { } block.

firewall {
    global-options {
        all-ping enable;
        broadcast-ping disable;
        ip-src-route disable;
        ipv6-src-route disable;
        log-martians enable;
        receive-redirects disable;
        send-redirects disable;
        syn-cookies enable;
    }
}

These map to their corresponding net.ipv4.* / net.ipv6.* sysctls and are applied through the sysctl plugin for three-layer precedence.

FlowSpec-to-firewall bridge

The flowspec-firewall plugin converts BGP FlowSpec rules into nftables firewall entries. When a peer announces FlowSpec routes, the plugin translates the FlowSpec match/action into an nftables rule in a dedicated ze_flowspec table.

plugin {
    external flowspec-fw { use flowspec-firewall; encoder json; }
}

bgp {
    peer upstream {
        process flowspec-fw { receive [ update ]; }
    }
}

CLI

Command	Description
show firewall	Display all firewall tables and rules.
show firewall counters	Per-term packet and byte counters.
clear firewall counters	Reset match counters.

See also

• Traffic Control for per-interface queueing disciplines.
• Policy Routing for nftables-based PBR.
• VPP Data Plane for the VPP integration.
• Plugins for the plugin list.

Adapted from main/docs/guide/firewall.md.