Updated efg.pm (added mx.pm rules).

diff --git a/sources/efg.pm/c3d/firstboot/data/nftables.config b/sources/efg.pm/c3d/firstboot/data/nftables.config
index cfb64af637fcbc8ca81532b78edd3dff29ba1b94..31fa22bcdde279ef92a40c2f45b3329717ef3637 100644 (file)
--- a/sources/efg.pm/c3d/firstboot/data/nftables.config
+++ b/sources/efg.pm/c3d/firstboot/data/nftables.config
@@ -263,6 +263,17 @@ add rule ip efg-filter forward \
     oifname $EXTERNAL_IF tcp dport 1024-65535 \
     counter accept comment "Outgoing MX replies"
 
+add rule ip efg-filter forward \
+    iifname $PERIMETER_IF ip saddr $MX_PERIMETER_IPV4 tcp sport 1024-65535 \
+    oifname $EXTERNAL_IF tcp dport $MX_PORTS \
+    counter accept comment "Outgoing MX requests"
+
+add rule ip efg-filter forward \
+    ct state established \
+    iifname $EXTERNAL_IF tcp sport $MX_PORTS \
+    oifname $PERIMETER_IF ip daddr $MX_PERIMETER_IPV4 tcp dport 1024-65535 \
+    counter accept comment "Incoming MX replies"
+
 add rule ip efg-filter forward \
     iifname $EXTERNAL_IF \
     oifname $PERIMETER_IF ip daddr $NETLOCK_INTERNAL_IPV4 tcp dport ssh \