T5794: firewall: change firewall priority in oder to be loaded after all interfaces

[nicolas-fort]

Change Summary

Load firewall after all interfaces are created in the system.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T5794

Related PR(s)

Component(s) name

firewall

Proposed changes

How to test

Config shared in the example works and is correctly loaded into the system after reboot:

set firewall flowtable FT01 interface 'bond0'
set firewall flowtable FT01 interface 'bond0.2'
set firewall ipv4 forward filter default-action 'drop'
set firewall ipv4 forward filter rule 10 action 'offload'
set firewall ipv4 forward filter rule 10 offload-target 'FT01'
set firewall ipv4 forward filter rule 10 state 'established'
set firewall ipv4 forward filter rule 10 state 'related'
set firewall ipv4 forward filter rule 20 action 'accept'
set firewall ipv4 forward filter rule 20 state 'established'
set firewall ipv4 forward filter rule 20 state 'related'
set interfaces bonding bond0 address '192.168.1.1/24'
set interfaces bonding bond0 member interface 'eth0'
set interfaces bonding bond0 vif 2 address '192.168.2.1/24'

And nftables:

sudo nft list table ip vyos_filter
table ip vyos_filter {
        flowtable VYOS_FLOWTABLE_FT01 {
                hook ingress priority filter
                devices = { bond0, bond0.2 }
                counter
        }

        chain VYOS_FORWARD_filter {
                type filter hook forward priority filter; policy accept;
                ct state { established, related } counter packets 0 bytes 0 flow add @VYOS_FLOWTABLE_FT01 comment "ipv4-FWD-filter-10"
                ct state { established, related } counter packets 0 bytes 0 accept comment "ipv4-FWD-filter-20"
                counter packets 0 bytes 0 drop comment "FWD-filter default-action drop"
        }

Smoketest result

test_firewall --> OK

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• I have run the components SMOKETESTS if applicable
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[c-po]

@Mergifyio backport sagitta circinus

[mergify]

backport sagitta circinus

✅ Backports have been created

• #3990 T5794: firewall: change firewall priority in oder to be loaded after all interfaces (backport #3988) has been created for branch sagitta
• #3991 T5794: firewall: change firewall priority in oder to be loaded after all interfaces (backport #3988) has been created for branch circinus

[ruffy91]

Won't this accept/allow all connections on startup until the firewall has been loaded, as the default action of the firewall without config is to accept all connections?

[astr0n8t]

T5794: firewall: change firewall priority in oder to be loaded after all interfaces (backport #3988) #3991

Can there maybe be a hook that just sets the default policy to DROP everything non-localhost on boot and then resets the policy to ACCEPT or the config during the firewall config apply phase?

Idk how it would look in nftables, but iptables commands would just be

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -I INPUT -i lo0 -j ACCEPT

For now I'm just gonna place this in /config/scripts/vyos-preconfig-bootup.script