65 lines
1.7 KiB
Plaintext
65 lines
1.7 KiB
Plaintext
|
# Sample configuration for nftables service.
|
||
|
|
# Load this by calling 'nft -f /etc/nftables/main.nft'.
|
||
|
|
|
||
|
|
# Note about base chain priorities:
|
||
|
|
# The priority values used in these sample configs are
|
||
|
|
# offset by 20 in order to avoid ambiguity when firewalld
|
||
|
|
# is also running which uses an offset of 10. This means
|
||
|
|
# that packets will traverse firewalld first and if not
|
||
|
|
# dropped/rejected there will hit the chains defined here.
|
||
|
|
# Chains created by iptables, ebtables and arptables tools
|
||
|
|
# do not use an offset, so those chains are traversed first
|
||
|
|
# in any case.
|
||
|
|
|
||
|
|
# drop any existing nftables ruleset
|
||
|
|
flush ruleset
|
||
|
|
|
||
|
|
# a common table for both IPv4 and IPv6
|
||
|
|
table inet nftables_svc {
|
||
|
|
|
||
|
|
# protocols to allow
|
||
|
|
set allowed_protocols {
|
||
|
|
type inet_proto
|
||
|
|
elements = { icmp, icmpv6 }
|
||
|
|
}
|
||
|
|
|
||
|
|
# interfaces to accept any traffic on
|
||
|
|
set allowed_interfaces {
|
||
|
|
type ifname
|
||
|
|
elements = { "lo" }
|
||
|
|
}
|
||
|
|
|
||
|
|
# services to allow
|
||
|
|
set allowed_tcp_dports {
|
||
|
|
type inet_service
|
||
|
|
elements = { ssh, 9090 }
|
||
|
|
}
|
||
|
|
|
||
|
|
# this chain gathers all accept conditions
|
||
|
|
chain allow {
|
||
|
|
ct state established,related accept
|
||
|
|
|
||
|
|
meta l4proto @allowed_protocols accept
|
||
|
|
iifname @allowed_interfaces accept
|
||
|
|
tcp dport @allowed_tcp_dports accept
|
||
|
|
}
|
||
|
|
|
||
|
|
# base-chain for traffic to this host
|
||
|
|
chain INPUT {
|
||
|
|
type filter hook input priority filter + 20
|
||
|
|
policy accept
|
||
|
|
|
||
|
|
jump allow
|
||
|
|
reject with icmpx type port-unreachable
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# By default, any forwarding traffic is allowed.
|
||
|
|
# Uncomment the following line to filter it based
|
||
|
|
# on the same criteria as input traffic.
|
||
|
|
#include "/etc/nftables/router.nft"
|
||
|
|
|
||
|
|
# Uncomment the following line to enable masquerading of
|
||
|
|
# forwarded traffic. May be used with or without router.nft.
|
||
|
|
#include "/etc/nftables/nat.nft"
|