projects
/
config
/
nftables.git
/ blobdiff
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
Add a Makefile to make it easier to deploy the configuration
[config/nftables.git]
/
nftables-workstation.nft
diff --git
a/nftables-workstation.nft
b/nftables-workstation.nft
index
3f1f446
..
c1ffd80
100644
(file)
--- a/
nftables-workstation.nft
+++ b/
nftables-workstation.nft
@@
-39,11
+39,8
@@
table inet filter {
}
chain input {
}
chain input {
- type filter hook input priority 0;
-
- ct state established,related accept
- ct state invalid drop
- ct state new jump in-new
+ type filter hook input priority 0
+ policy drop
iif lo accept
iif lo accept
@@
-66,7
+63,7
@@
table inet filter {
packet-too-big
} accept
packet-too-big
} accept
- # Allow
auto configuration support
.
+ # Allow
IPv6 Neighbor Discovery (RFC4861)
.
ip6 nexthdr ipv6-icmp icmpv6 type {
nd-router-advert,
nd-router-solicit,
ip6 nexthdr ipv6-icmp icmpv6 type {
nd-router-advert,
nd-router-solicit,
@@
-75,7
+72,8
@@
table inet filter {
} ip6 hoplimit 255 accept
# Allow multicast listener discovery on link-local addresses.
} ip6 hoplimit 255 accept
# Allow multicast listener discovery on link-local addresses.
- ip6 nexthdr ipv6-icmp icmpv6 type {
+ # RFC2710 specifies that a Hop-by-Hop Options header is used.
+ hbh nexthdr ipv6-icmp icmpv6 type {
mld-listener-query,
mld-listener-report,
mld-listener-reduction
mld-listener-query,
mld-listener-report,
mld-listener-reduction
@@
-90,6
+88,11
@@
table inet filter {
# Allow IGMPv3 queries.
ip protocol igmp ip daddr 224.0.0.1 accept
# Allow IGMPv3 queries.
ip protocol igmp ip daddr 224.0.0.1 accept
+ # Stateful filtering for anything else.
+ ct state established,related accept
+ ct state invalid drop
+ ct state new jump in-new
+
# Silently drop other incoming broadcast and multicast traffic.
meta pkttype {broadcast, multicast} drop
# Silently drop other incoming broadcast and multicast traffic.
meta pkttype {broadcast, multicast} drop
@@
-122,13
+125,17
@@
table inet filter {
}
chain forward {
}
chain forward {
- type filter hook forward priority 0;
+ type filter hook forward priority 0
+ policy drop
+
limit rate 3/minute burst 10 packets log prefix "[FORWARD]: "
counter reject
}
chain output {
limit rate 3/minute burst 10 packets log prefix "[FORWARD]: "
counter reject
}
chain output {
- type filter hook output priority 0;
+ type filter hook output priority 0
+ policy drop
+
counter accept
}
}
counter accept
}
}