ant/workstation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update nftables rules

Browse source
This commit is contained in:
Anthony Rose 2023-10-12 09:25:11 +01:00
parent 36af7f9478
commit 4308d7e6bd
1 changed files with 8 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
roles/debian/files/nftables.conf
View file

@ -4,7 +4,7 @@ flush ruleset
table inet filter { table inet filter {
chain input { chain input {
type filter hook input priority 0; policy accept; type filter hook input priority filter; policy accept;
# Accept any localhost and libvirt traffic. # Accept any localhost and libvirt traffic.
iif "lo" accept iif "lo" accept
@ -14,30 +14,27 @@ table inet filter {
ct state established,related accept ct state established,related accept
# Open ports for public services. # Open ports for public services.
tcp dport 22 ct state new accept # SSH tcp dport 22 ct state new accept # SSH
tcp dport 5353 ct state new accept # Bonjour
udp dport 5353 ct state new accept # Bonjour
tcp dport 8000 ct state new accept # Python HTTP server.
# Accept neighbour discovery otherwise IPv6 connectivity breaks. # ICMPv6 packets which must not be dropped, see https://tools.ietf.org/html/rfc4890#section-4.4.1
ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
ip6 saddr fe80::/10 icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report, 151, 152, 153 } accept
# Count and drop any other traffic. # Count and drop any other traffic.
counter drop counter drop
} }
chain forward { chain forward {
type filter hook forward priority 0; policy accept; type filter hook forward priority filter; policy accept;
} }
chain output { chain output {
type filter hook output priority 0; policy accept; type filter hook output priority filter; policy accept;
} }
} }
table ip nat { table ip nat {
chain postrouting { chain postrouting {
type nat hook postrouting priority 100; type nat hook postrouting priority srcnat; policy accept;
# Masquerade NAT traffic (useful for VMs). # Masquerade NAT traffic (useful for VMs).
masquerade masquerade