From f89b113049deb36cbc755398adc275ad76b6cc4b Mon Sep 17 00:00:00 2001 From: Raphael Dannecker Date: Wed, 17 Dec 2025 18:50:16 +0100 Subject: [PATCH] Enable ARP support in nftable for outbound restriction in exam_mode --- roles/lmn_exam/templates/no-way-out-nftable.j2 | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/roles/lmn_exam/templates/no-way-out-nftable.j2 b/roles/lmn_exam/templates/no-way-out-nftable.j2 index 2c6efb8..93305a9 100644 --- a/roles/lmn_exam/templates/no-way-out-nftable.j2 +++ b/roles/lmn_exam/templates/no-way-out-nftable.j2 @@ -13,15 +13,17 @@ ${filterchain} chain filterin_${interface} { type filter hook ingress device ${interface} priority filter; policy drop; ip saddr \$allowed_ipv4 accept - ip saddr ${gateway} accept; - ip saddr 255.255.255.255 accept; + ip saddr ${gateway} accept + ip saddr 255.255.255.255 accept + ether type arp accept } chain filterout_${interface} { type filter hook egress device ${interface} priority filter; policy drop; ip daddr \$allowed_ipv4 accept - ip daddr ${gateway} accept; - ip daddr 255.255.255.255 accept; + ip daddr ${gateway} accept + ip daddr 255.255.255.255 accept + ether type arp accept } EOF )