bifrost: ...

2 files changed, 13 insertions, 11 deletions

diff --git a/hosts/surtr/ruleset.nft b/hosts/surtr/ruleset.nft
index 9d6fd373..998bd037 100644
--- a/hosts/surtr/ruleset.nft
+++ b/hosts/surtr/ruleset.nft
@@ -44,10 +44,12 @@ table inet filter {
 
     iifname lo counter accept
 
-    meta l4proto $icmp_protos iifname {yggdrasil, bifrost} oifname ens3 limit name lim_icmp counter drop
-    meta l4proto $icmp_protos iifname {yggdrasil, bifrost} oifname ens3 counter accept
+    meta l4proto $icmp_protos iifname {yggdrasil, bifrost} oifname {bifrost, ens3} limit name lim_icmp counter drop
+    meta l4proto $icmp_protos iifname {yggdrasil, bifrost} oifname {bifrost, ens3} counter accept
     meta l4proto $icmp_protos ct state {established, related} limit name lim_icmp counter drop
     meta l4proto $icmp_protos ct state {established, related} counter accept
+    meta l4proto $icmp_protos oifname bifrost limit name lim_icmp counter drop
+    meta l4proto $icmp_protos oifname bifrost counter accept
 
 
     oifname bifrost counter accept
diff --git a/hosts/vidhar/network/ruleset.nft b/hosts/vidhar/network/ruleset.nft
index 7b2160d1..f2b1eda0 100644
--- a/hosts/vidhar/network/ruleset.nft
+++ b/hosts/vidhar/network/ruleset.nft
@@ -117,10 +117,10 @@ table inet filter {
 
 
   chain forward_icmp_accept {
-    oifname dsl limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
-    iifname dsl limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
-    oifname != dsl limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
-    iifname != dsl limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    oifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
+    iifname { dsl, bifrost } limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-fw drop
+    oifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
+    iifname != { dsl, bifrost } limit name lim_icmp_local counter name icmp-ratelimit-local-fw drop
     counter name icmp-fw accept
   }
   chain forward {
@@ -133,7 +133,7 @@ table inet filter {
 
     iifname lo counter name fw-lo accept
 
-    oifname {lan, dsl} meta l4proto $icmp_protos jump forward_icmp_accept
+    oifname { lan, dsl, bifrost } meta l4proto $icmp_protos jump forward_icmp_accept
 
     iifname lan oifname { dsl, bifrost } counter name fw-lan accept
     iifname dsl oifname { lan, dmz01 } ct state {established, related} counter name fw-dsl accept
@@ -158,8 +158,8 @@ table inet filter {
     iif != lo ip daddr 127.0.0.1/8 counter name invalid-local4-rx reject
     iif != lo ip6 daddr ::1/128 counter name invalid-local6-rx reject
 
-    iifname dsl meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-rx drop
-    iifname != dsl meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
+    iifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-rx drop
+    iifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-rx drop
     meta l4proto $icmp_protos counter name icmp-rx accept
 
     iifname { lan, mgmt, dsl, yggdrasil, bifrost } tcp dport 22 counter name ssh-rx accept
@@ -201,8 +201,8 @@ table inet filter {
 
     oifname lo counter name tx-lo accept
 
-    oifname dsl meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-tx drop
-    oifname != dsl meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
+    oifname { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_dsl counter name icmp-ratelimit-dsl-tx drop
+    oifname != { bifrost, dsl } meta l4proto $icmp_protos limit name lim_icmp_local counter name icmp-ratelimit-local-tx drop
     meta l4proto $icmp_protos counter name icmp-tx accept