rc/friwall
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add setting to disable NAT for a given destination IP set

Browse source
This commit is contained in:
Timotej Lazar 2024-09-16 16:24:09 +02:00
parent 5f1e1ae3e7
commit 0fa06ecbba
2 changed files with 14 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

9
web/system.py
View file

@ -131,10 +131,15 @@ def save_config():
# Print dynamic NAT rules.
with open(output / 'etc/nftables.d/nat.nft', 'w', encoding='utf-8') as f:
nft_nat = 'iif @inside oif @outside ip saddr @{name} snat to {nat}\n'
no_nat_set = settings.get('no_nat_set')
nft_nat = 'iif @inside oif @outside ip saddr @{name}'
if no_nat_set:
# don’t NAT for these destination addresses
nft_nat += ' ip daddr != @{no_nat_set}'
nft_nat += ' snat to {nat}\n'
for name, data in sets.items():
if nat := data.get('nat'):
f.write(nft_nat.format(name=name, nat=nat))
f.write(nft_nat.format(name=name, nat=nat, no_nat_set=no_nat_set))
# Print forwarding rules.
with open(output / 'etc/nftables.d/forward.nft', 'w', encoding='utf-8') as f: