firewall/examples/infra.yaml

---
zones:
  users-internet-allowed:
    file: examples/infra_included.yaml

  mgmt:
    addrs: 10.203.0.0/16

  adm:
    addrs: [2a09:6840::/29, 10.128.0.0/16]

  internet:
    negate: true
    zones: [adm, mgmt]

  interco-crans:
    addrs: 10.0.0.1/32


blacklist:
  blocked: adm


reverse_path_filter:
  interfaces: back0


filter:
  input:
    - iif: lo
      verdict: accept

    - src: adm
      protocols:
        icmp: true
        ospf: true
        vrrp: true
      verdict: accept

    - src: [adm, 10.10.10.10]
      protocols:
        tcp:
          dport: 179
      verdict: accept

    - src: mgmt
      protocols:
        tcp:
          dport: [22, 240..242]
      verdict: accept

    - protocols:
        icmp: true
      verdict: accept

  output:
    - verdict: accept


  forward:
    - src: interco-crans
      verdict: accept

    - src: users-internet-allowed
      protocols:
        tcp:
          dport: [25]
      verdict: drop

    - src: users-internet-allowed
      dst: [10.0.0.1, internet]
      verdict: accept

nat:
  - src: 100.64.0.0/26
    dst: internet
    snat:
      addr: 45.66.108.0/28
  - src: 100.64.0.0/26
    dst: internet
    snat:
      addr: 45.66.108.1
      port: 1000..5000
...