network/roles/firewall/templates/mgmt.intf.j2
Timotej Lazar f54b23f49a firewall: disable forwarding for mgmt interfaces in if-pre-up
Should be more robust and more importantly works when interfaces are
not renamed by mdev as is the situation now.
2024-01-30 13:11:35 +01:00

27 lines
832 B
Django/Jinja

auto mgmt
iface mgmt
pre-up ip link add $IFACE type vrf table 100
up ip link set dev $IFACE up
post-down ip link del $IFACE
{% for iface in interfaces | selectattr('name', 'match', '^mgmt') %}
auto {{ iface.name }}
iface {{ iface.name }}
{% if iface.vrf %}
requires {{ iface.vrf.name }}
pre-up ip link set $IFACE master {{ iface.vrf.name }}
{% endif %}
pre-up sysctl -w net.ipv4.conf.$IFACE.forwarding=0
pre-up sysctl -w net.ipv6.conf.$IFACE.forwarding=0
{% if iface.mtu %}
mtu {{ iface.mtu }}
{% endif %}
{% for addr in iface.ip_addresses %}
address {{ addr.address }}
{% endfor %}
{% if iface.custom_fields.gateway %}
up ip route add default via {{ iface.custom_fields.gateway.address | ipaddr('address') }}{% if iface.vrf %} vrf {{ iface.vrf.name }}{% endif %}
{% endif +%}
{% endfor %}