42 lines
1.2 KiB
Text
Executable file
42 lines
1.2 KiB
Text
Executable file
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority filter; policy accept;
|
|
|
|
# Accept any localhost and libvirt traffic.
|
|
iif "lo" accept
|
|
iifname "virbr0" accept
|
|
|
|
# Accept traffic originated from us.
|
|
ct state established,related accept
|
|
|
|
# Open ports for public services.
|
|
tcp dport 22 ct state new accept # SSH
|
|
|
|
# ICMPv6 packets which must not be dropped, see https://tools.ietf.org/html/rfc4890#section-4.4.1
|
|
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, 148, 149 } accept
|
|
ip6 saddr fe80::/10 icmpv6 type { mld-listener-query, mld-listener-report, mld-listener-done, mld2-listener-report, 151, 152, 153 } accept
|
|
|
|
# Count and drop any other traffic.
|
|
counter drop
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy accept;
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter; policy accept;
|
|
}
|
|
}
|
|
table ip nat {
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
|
|
# Masquerade NAT traffic (useful for VMs).
|
|
masquerade
|
|
}
|
|
}
|