You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
64 lines
1.9 KiB
64 lines
1.9 KiB
#!/usr/bin/nft -f |
|
|
|
# IPv4/IPv6 Simple & Safe firewall ruleset. |
|
# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/. |
|
|
|
|
|
define NET_LXD = 10.98.46.0/24 |
|
|
|
|
|
flush ruleset |
|
|
|
table inet filter { |
|
chain input { |
|
type filter hook input priority filter; policy drop; |
|
|
|
ct state invalid drop comment "early drop of invalid connections" |
|
ct state {established, related} accept comment "allow tracked connections" |
|
iifname lo accept comment "allow from loopback" |
|
ip protocol icmp accept comment "allow icmp" |
|
#ip protocol icmp type { echo-request, echo-reply } accept comment "allow icmp" |
|
#meta l4proto ipv6-icmp accept comment "allow icmp v6" |
|
|
|
ip saddr $NET_LXD accept |
|
|
|
jump in.lxdbr0 |
|
|
|
pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited |
|
counter |
|
} |
|
|
|
chain output { |
|
type filter hook output priority filter; policy accept; |
|
jump out.lxdbr0 |
|
} |
|
|
|
chain forward { |
|
type filter hook forward priority filter; policy drop; |
|
jump fwd.lxdbr0 |
|
} |
|
|
|
chain pstrt.lxdbr0 { |
|
type nat hook postrouting priority srcnat; policy accept; |
|
ip saddr 10.98.46.0/24 ip daddr != 10.98.46.0/24 masquerade |
|
} |
|
|
|
chain fwd.lxdbr0 { |
|
ip version 4 oifname "lxdbr0" accept |
|
ip version 4 iifname "lxdbr0" accept |
|
} |
|
|
|
chain in.lxdbr0 { |
|
iifname "lxdbr0" tcp dport 53 accept |
|
iifname "lxdbr0" udp dport 53 accept |
|
iifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept |
|
iifname "lxdbr0" udp dport 67 accept |
|
} |
|
|
|
chain out.lxdbr0 { |
|
oifname "lxdbr0" tcp sport 53 accept |
|
oifname "lxdbr0" udp sport 53 accept |
|
oifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept |
|
oifname "lxdbr0" udp sport 67 accept |
|
} |
|
}
|
|
|