option 'src' must not be a list

[brianjmurrell]

Simply for the simplification of rules and the DRY principle, one should be able to use src items in a list.

Firewall4 should accept that syntax and generate however many rules are necessary in nftables to actually implement the policy.

[brada4]

Could be useful to allow dhcp for 5 guest nets....
Similar thing is done in one place parse_reflection_source / fw4.uc - synthetic rules are generated as needed for reflection_src.

[brianjmurrell]

Guest nets (or any other kinds of VLANS) is one use case. VPNs subnets are another.

Maybe you want to treat your VPNs with the same policy as your LAN users… Being able to use all of those srcs in the same rule is very handy.

[brada4]

Yeah it is cool, but it needs to be done for every rule type at least few lines...

[brianjmurrell]

And of course this doesn't mean just src. dest should have the same treatment.

Fulfilling this ticket would greatly reduce the amount of repetition in my rules. Repetition means unnecessarily large rule sets. Large rulesets increase the probability of errors, putting one's security at risk.

[brada4]

That is not universally true.

[brianjmurrell]

Which part?

Probably very little in this world is universally true but I think my statements are generally true of anything more complicated than a simple two-armed router.

I'm certainly not alone in this request. Google finds quite a few questions for it. There are forum threads about it.