From 6283f49713d1ab2e81bff6a55148ca05e477f39c Mon Sep 17 00:00:00 2001 From: Daniel Ding Date: Thu, 11 Jan 2024 20:17:32 +0800 Subject: [PATCH] fix: output from vrf dont goto zone --- pkg/switch/network.go | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/pkg/switch/network.go b/pkg/switch/network.go index 4bc6a02..c64dfca 100755 --- a/pkg/switch/network.go +++ b/pkg/switch/network.go @@ -677,6 +677,7 @@ func (w *WorkerImpl) forwardZone(input string) { if w.table == 0 { return } + w.out.Debug("WorkerImpl.forwardZone %s", input) w.fire.Raw.Pre.AddRule(cn.IPRule{ Input: input, @@ -690,6 +691,12 @@ func (w *WorkerImpl) forwardZone(input string) { Zone: uint32(w.table), Comment: "Goto private zone", }) + w.fire.Raw.Out.AddRule(cn.IPRule{ + Output: input, + Jump: cn.CCT, + Zone: uint32(w.table), + Comment: "Goto private zone", + }) } func (w *WorkerImpl) forwardVPN() { @@ -699,9 +706,6 @@ func (w *WorkerImpl) forwardVPN() { } devName := vpn.Device - - w.forwardZone(devName) - _, port := libol.GetHostPort(vpn.Listen) if vpn.Protocol == "udp" { w.openPort("udp", port, "Open VPN") @@ -709,6 +713,8 @@ func (w *WorkerImpl) forwardVPN() { w.openPort("tcp", port, "Open VPN") } + w.forwardZone(devName) + // Enable MASQUERADE, and FORWARD it. w.toRelated(devName, "Accept related") w.toACL(cfg.Acl, devName)