sample_nftables-mixed-multiple-headers-combo.pol

# Test rendering for multiple nftables policies.

header {
  comment:: "Noverbose + custom priority policy example"
  target:: nftables mixed INPUT 300
}

term multi-all-families {
  comment:: "Validate multiple protocols."
  protocol:: udp tcp icmp icmpv6
  action:: accept
}

term multi-proto-term {
  comment:: "Validate multiple protocols. IPv6 icmp should not render."
  protocol:: udp tcp icmp
  action:: accept
}

header {
  comment:: "Noverbose + custom priority policy example"
  target:: nftables mixed INPUT 400
}

term test-tcp-icmp {
  comment:: "Allow ICMP from company."
  source-address:: PUBLIC_NAT
  protocol:: udp tcp icmp
  action:: accept
}

header {
  comment:: "Noverbose + custom priority policy example"
  target:: nftables mixed OUTPUT
}

term test-icmp {
  comment:: "Allow ICMP from company."
  source-address:: PUBLIC_NAT
  protocol:: icmp
  action:: accept
}

term test-icmp-type-ip4 {
  comment:: "IPv4 icmp-type test"
  icmp-type:: echo-request echo-reply
  protocol:: icmp
  action:: accept
}

term test-icmp-type-ip6 {
  comment:: "IPv6 icmp-type test"
  icmp-type:: multicast-listener-done router-solicit router-advertisement
  protocol:: icmpv6
  action:: accept
}

term full-combo-term {
  comment:: "Test src/dest 80 - with addresses"
  source-address:: CLOUDFLARE_PUBLIC_DNS
  destination-address:: GOOGLE_PUBLIC_DNS_ANYCAST
  protocol:: tcp
  source-port:: HTTP
  destination-port:: HTTP
  action:: accept
}

term multi-all-families {
  comment:: "Validate multiple protocols."
  protocol:: udp tcp icmp icmpv6
  action:: accept
}

term base-traceroute-in {
  comment:: "Ensure we can output a port-range."
  protocol:: udp
  source-port:: TRACEROUTE
  destination-port:: HIGH_PORTS
  action:: accept
}