From 4308d7e6bd08522b0f23ae40ea80d3ec99803a11 Mon Sep 17 00:00:00 2001 From: Anthony Perkins Date: Thu, 12 Oct 2023 09:25:11 +0100 Subject: [PATCH] Update nftables rules --- roles/debian/files/nftables.conf | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/roles/debian/files/nftables.conf b/roles/debian/files/nftables.conf index 5412314..e8d43ad 100755 --- a/roles/debian/files/nftables.conf +++ b/roles/debian/files/nftables.conf @@ -4,7 +4,7 @@ flush ruleset table inet filter { chain input { - type filter hook input priority 0; policy accept; + type filter hook input priority filter; policy accept; # Accept any localhost and libvirt traffic. iif "lo" accept @@ -14,30 +14,27 @@ table inet filter { ct state established,related accept # Open ports for public services. - tcp dport 22 ct state new accept # SSH - tcp dport 5353 ct state new accept # Bonjour - udp dport 5353 ct state new accept # Bonjour - tcp dport 8000 ct state new accept # Python HTTP server. + tcp dport 22 ct state new accept # SSH - # Accept neighbour discovery otherwise IPv6 connectivity breaks. - ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept + # ICMPv6 packets which must not be dropped, see https://tools.ietf.org/html/rfc4890#section-4.4.1 + icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept + ip6 saddr fe80::/10 icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report, 151, 152, 153 } accept # Count and drop any other traffic. counter drop } chain forward { - type filter hook forward priority 0; policy accept; + type filter hook forward priority filter; policy accept; } chain output { - type filter hook output priority 0; policy accept; + type filter hook output priority filter; policy accept; } } - table ip nat { chain postrouting { - type nat hook postrouting priority 100; + type nat hook postrouting priority srcnat; policy accept; # Masquerade NAT traffic (useful for VMs). masquerade