ansible-roles/system/base/nftables/templates/nftables.conf.j2

47 lines
1.7 KiB
Plaintext
Raw Normal View History

2022-12-20 19:47:11 +01:00
#!/usr/sbin/nft -f
table inet filter
delete table inet filter
table inet filter {
chain input {
type filter hook input priority 0;
# Accept any localhost traffic.
iif lo accept;
{% if system_base_interfaces_iifname %}
# Accept any traffic on these interfaces.
iifname { {{ system_base_interfaces_iifname | join(", ") }} } accept;
{% endif %}
2022-12-20 19:47:11 +01:00
# Accept traffic originated from us.
ct state established,related accept;
# Allow ICMP packets.
# Note that for IPv6 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert are needed to not break connectivity.
ip6 nexthdr icmpv6 icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } accept;
ip protocol icmp icmp type { echo-request, destination-unreachable, router-advertisement, time-exceeded, parameter-problem } accept;
# Drop invalid connections.
ct state invalid drop;
# TCP ports.
tcp dport { {{ [ansible_port] | union(system_base_additional_tcp_ports) | join(", ") }} } ct state new accept;
{% if system_base_udp_ports %}
# UDP ports.
udp dport { {{ system_base_udp_ports | join(", ") }} } accept;
{% endif %}
# Count and drop any other traffic.
counter drop;
}
chain forward {
type filter hook forward priority 0;
}
chain output {
type filter hook output priority 0;
}
}