mirror of
https://github.com/kernelkit/infix.git
synced 2026-07-30 04:33:00 +02:00
Joachim Wiberg
56ea7faa7c
Add firewall address-sets: named sets of IP addresses and networks, usable as zone sources for per-IP access control, issue #1189. Static entries are part of the configuration; dynamic entries are managed at runtime with new add/remove/flush actions, from the CLI or over NETCONF/RESTCONF. Dynamic entries survive firewall configuration changes but are not saved to the configuration. Sets with a timeout expire their entries automatically. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
62 lines
1.2 KiB
JSON
62 lines
1.2 KiB
JSON
{
|
|
"infix-firewall:firewall": {
|
|
"default": "public",
|
|
"logging": "all",
|
|
"zone": [
|
|
{
|
|
"name": "mgmt",
|
|
"action": "accept",
|
|
"interface": ["e0"],
|
|
"service": ["ssh", "netconf", "restconf"]
|
|
},
|
|
{
|
|
"name": "public",
|
|
"action": "drop",
|
|
"interface": ["e1"]
|
|
},
|
|
{
|
|
"name": "trusted",
|
|
"action": "accept",
|
|
"address-set": ["allowed", "greylist"]
|
|
}
|
|
],
|
|
"address-set": [
|
|
{
|
|
"name": "allowed",
|
|
"family": "ipv4",
|
|
"current": [
|
|
{
|
|
"entry": "192.168.1.40",
|
|
"dynamic": false
|
|
},
|
|
{
|
|
"entry": "192.168.1.50",
|
|
"dynamic": true
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"name": "greylist",
|
|
"family": "ipv4",
|
|
"timeout": 10,
|
|
"current": [
|
|
{
|
|
"entry": "192.168.1.60",
|
|
"dynamic": true,
|
|
"expires": 7
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"policy": [
|
|
{
|
|
"name": "public-to-mgmt",
|
|
"action": "reject",
|
|
"priority": 100,
|
|
"ingress": ["public"],
|
|
"egress": ["mgmt"]
|
|
}
|
|
]
|
|
}
|
|
}
|