ansible-edda/playbooks/filesystem/yggdrasil/etc/nftables.conf.j2

36 lines
1.3 KiB
Plaintext
Raw Normal View History

2022-08-30 15:25:28 +02:00
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
2022-09-21 23:57:15 +02:00
chain input {
type filter hook input priority 0;
2022-08-30 15:39:31 +02:00
# Accept any localhost traffic.
iif lo accept;
# Accept traffic originated from us.
ct state established,related accept;
# Allow ICMP packets.
# Note that for IPv6 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert are needed to not break connectivity.
ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept;
ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept;
2022-09-21 23:57:15 +02:00
# Drop invalid connections.
ct state invalid drop;
2022-08-30 15:39:31 +02:00
2022-09-24 00:15:46 +02:00
# Accept HTTP, HTTPS, SSH.
2022-11-15 23:01:51 +01:00
tcp dport { 80, 443, {{ ansible_port }}, {{ services['git'].ssh_port }} } ct state new accept;
2022-08-30 15:39:31 +02:00
# Count and drop any other traffic.
counter drop;
2022-09-21 23:57:15 +02:00
}
chain forward {
type filter hook forward priority 0;
}
chain output {
type filter hook output priority 0;
}
2022-08-30 15:25:28 +02:00
}