ansible-edda/playbooks/roles/system/nftables/templates/nftables.conf.j2

42 lines
1.5 KiB
Plaintext
Raw Normal View History

2022-08-30 15:25:28 +02:00
#!/usr/sbin/nft -f
table inet filter
delete table inet filter
2022-08-30 15:25:28 +02:00
table inet filter {
2022-09-21 23:57:15 +02:00
chain input {
type filter hook input priority 0;
2022-08-30 15:39:31 +02:00
# Accept any localhost traffic.
iif lo accept;
# Accept traffic originated from us.
ct state established,related accept;
# Allow ICMP packets.
# Note that for IPv6 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert are needed to not break connectivity.
ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept;
ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept;
2022-09-21 23:57:15 +02:00
# Drop invalid connections.
ct state invalid drop;
2022-08-30 15:39:31 +02:00
# TCP ports.
2022-12-08 23:19:54 +01:00
tcp dport { {{ [ansible_port] | union(system_base_additional_tcp_ports) | join(", ") }} } ct state new accept;
2022-08-30 15:39:31 +02:00
2022-12-08 23:19:54 +01:00
{% if system_base_udp_ports %}
# UDP ports.
2022-12-08 23:19:54 +01:00
udp dport { {{ system_base_udp_ports | join(", ") }} } accept;
2022-09-24 00:15:46 +02:00
{% endif %}
2022-08-30 15:39:31 +02:00
# Count and drop any other traffic.
counter drop;
2022-09-21 23:57:15 +02:00
}
chain forward {
type filter hook forward priority 0;
}
chain output {
type filter hook output priority 0;
}
2022-08-30 15:25:28 +02:00
}