ant/workstation
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update nftables rules

Browse source
This commit is contained in:
Anthony Rose 2023-10-12 09:25:11 +01:00
parent 36af7f9478
commit 4308d7e6bd
1 changed files with 8 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
roles/debian/files/nftables.conf
View file

@ -4,7 +4,7 @@ flush ruleset
table inet filter {
chain input {
type filter hook input priority 0; policy accept;
type filter hook input priority filter; policy accept;
# Accept any localhost and libvirt traffic.
iif "lo" accept
@ -15,29 +15,26 @@ table inet filter {
# Open ports for public services.
tcp dport 22 ct state new accept # SSH
tcp dport 5353 ct state new accept # Bonjour
udp dport 5353 ct state new accept # Bonjour
tcp dport 8000 ct state new accept # Python HTTP server.
# Accept neighbour discovery otherwise IPv6 connectivity breaks.
ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
# ICMPv6 packets which must not be dropped, see https://tools.ietf.org/html/rfc4890#section-4.4.1
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
ip6 saddr fe80::/10 icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report, 151, 152, 153 } accept
# Count and drop any other traffic.
counter drop
}
chain forward {
type filter hook forward priority 0; policy accept;
type filter hook forward priority filter; policy accept;
}
chain output {
type filter hook output priority 0; policy accept;
type filter hook output priority filter; policy accept;
}
}
table ip nat {
chain postrouting {
type nat hook postrouting priority 100;
type nat hook postrouting priority srcnat; policy accept;
# Masquerade NAT traffic (useful for VMs).
masquerade