SET domain-name on the firewall groups?

WebToor · September 23, 2022, 8:38am

Hi,

How to configure domain-name in firewall group rule “object”, not available for network/address group
Thanks to a script ?

best regards !

WebToor · September 23, 2022, 9:39am

Request Feature found :

github.com/vyos/vyos-1x

firewall: T970: Fix for Regex for domain and check empty group

vyos:current ← sever-sever:T970

opened 03:14PM - 10 Jun 22 UTC

sever-sever

+4 -3

## Change Summary It can be more than 5 symbols in a top-level-domain addre…ss for example `.photography` and `.accountants` A firewall group can be added without an address: ``` set firewall group domain-group DOMAIN``` Check if 'address' exists in group_config ## Types of changes  - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Code style update (formatting, renaming) - [ ] Refactoring (no functional changes) - [ ] Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component - [ ] Other (please describe): ## Related Task(s) * https://phabricator.vyos.net/T970 ## Component(s) name firewall ## Proposed changes ## How to test 1. Firewall domain group without address should not cause error: 2. Accept domains with > 5 top-level symbols ``` vyos@r12# set firewall group domain-group DOMAIN [edit] vyos@r12# commit [edit] vyos@r12# vyos@r12# set firewall group domain-group DOMAIN address dns.google [edit] vyos@r12# commit [edit] vyos@r12# ``` ## Checklist: - [x] I have read the [**CONTRIBUTING**](https://github.com/vyos/vyos-1x/blob/current/CONTRIBUTING.md) document - [x] I have linked this PR to one or more Phabricator Task(s) - [x] I have run the components [**SMOKETESTS**](https://github.com/vyos/vyos-1x/tree/current/smoketest/scripts/cli) if applicable - [x] My commit headlines contain a valid Task id - [ ] My change requires a change to the documentation - [ ] I have updated the documentation accordingly

github.com/vyos/vyos-1x

firewall: T970: Add firewall group domain-group

vyos:current ← sever-sever:T970

opened 10:04PM - 17 May 22 UTC

sever-sever

+228 -4

## Change Summary Domain group allows to filter addresses by domain Resolved… addresses as elements are stored to named "nft set" that used in the nftables rules Also added a dynamic "resolver" systemd daemon `vyos-domain-group-resolve.service` which starts python script for the domain-group addresses resolving by timeout 300 sec ## Types of changes  - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Code style update (formatting, renaming) - [ ] Refactoring (no functional changes) - [ ] Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component - [ ] Other (please describe): ## Related Task(s) * https://phabricator.vyos.net/T970 ## Component(s) name firewall ## Proposed changes ## How to test VyOS configuration: ``` set firewall group domain-group DOMAINS address 'example.com' set firewall group domain-group DOMAINS address 'example.org' set firewall name FOO default-action 'accept' set firewall name FOO rule 10 action 'drop' set firewall name FOO rule 10 source group domain-group 'DOMAINS' set interfaces ethernet eth0 firewall local name 'FOO' ``` Expected nft rules: ``` table ip filter { set DOMAINS { type ipv4_addr flags interval elements = { 192.0.2.1, 192.0.2.85, 203.0.113.55, 203.0.113.58 } } ... chain NAME_FOO { ip saddr @DOMAINS counter packets 0 bytes 0 drop comment "FOO-10" counter packets 0 bytes 0 return comment "FOO default-action accept" } } ``` ## Checklist: - [x] I have read the [**CONTRIBUTING**](https://github.com/vyos/vyos-1x/blob/current/CONTRIBUTING.md) document - [x] I have linked this PR to one or more Phabricator Task(s) - [x] I have run the components [**SMOKETESTS**](https://github.com/vyos/vyos-1x/tree/current/smoketest/scripts/cli) if applicable - [x] My commit headlines contain a valid Task id - [ ] My change requires a change to the documentation - [ ] I have updated the documentation accordingly

https://phabricator.vyos.net/T970

https://docs.bitnami.com/aws/apps/mattermost/administration/use-single-domain-nginx/

WebToor · September 23, 2022, 10:00am

Exemple on lab vyos :

VMWARE Workstation

system · September 25, 2022, 10:00am

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.