2024-12-10 12:46:48 -03:00
|
|
|
#!/usr/bin/nft
|
|
|
|
flush ruleset
|
|
|
|
|
2024-12-12 22:12:20 -03:00
|
|
|
include "./defines.nft"
|
2024-12-12 21:55:35 -03:00
|
|
|
|
2024-12-10 12:46:48 -03:00
|
|
|
table ip filter {
|
2024-12-12 21:55:35 -03:00
|
|
|
set allowed_tcp_ports {
|
|
|
|
type inet_service;
|
|
|
|
flags constant;
|
2024-12-13 03:04:52 -03:00
|
|
|
elements = {
|
|
|
|
$SSH_PORT1, $SSH_PORT2, $DNS_PORT, $HTTP_PORT, $HTTPS_PORT, $SYNCPLAY_PORT,
|
|
|
|
$TERRARIA_PORT, $OPENTTD_PORT, $MAINPAGE_PORT, $NEXTCLOUD_PORT, $GITEA_PORT,
|
|
|
|
$POSTGRESQL_PORT
|
|
|
|
};
|
2024-12-12 21:55:35 -03:00
|
|
|
}
|
2024-12-12 22:18:48 -03:00
|
|
|
|
|
|
|
set allowed_udp_ports_in {
|
|
|
|
type inet_service;
|
|
|
|
flags constant;
|
2024-12-13 03:04:52 -03:00
|
|
|
elements = { $DNS_PORT, $DHCP_IN_PORT, $OPENVPN_PORT, $FACTORIO_PORT, $OPENTTD_PORT, $CSTRIKE_PORT, $SNMP_POLL_PORT, $SNMP_TRAP_PORT }
|
2024-12-12 22:18:48 -03:00
|
|
|
}
|
|
|
|
|
|
|
|
set allowed_udp_ports_out {
|
|
|
|
type inet_service;
|
|
|
|
flags constant;
|
2024-12-13 03:04:52 -03:00
|
|
|
elements = { $DNS_PORT, $DHCP_OUT_PORT, $SNMP_POLL_PORT }
|
2024-12-12 22:18:48 -03:00
|
|
|
}
|
|
|
|
|
2024-12-10 12:46:48 -03:00
|
|
|
chain in {
|
|
|
|
type filter hook input priority filter; policy drop;
|
2024-12-13 02:45:55 -03:00
|
|
|
ct state vmap { invalid : drop, related : accept, established : accept };
|
2024-12-12 22:23:05 -03:00
|
|
|
iifname "lo" accept;
|
2024-12-12 21:55:35 -03:00
|
|
|
tcp dport @allowed_tcp_ports accept;
|
2024-12-12 22:18:48 -03:00
|
|
|
udp dport @allowed_udp_ports_in accept;
|
2024-12-10 12:46:48 -03:00
|
|
|
}
|
2024-12-13 00:49:09 -03:00
|
|
|
|
2024-12-10 12:46:48 -03:00
|
|
|
chain forward {
|
|
|
|
type filter hook forward priority filter; policy drop;
|
2024-12-13 00:49:09 -03:00
|
|
|
comment "this routes vpn traffic";
|
|
|
|
ct state related,established accept;
|
|
|
|
iifname "tun0" oifname "eth0" accept;
|
|
|
|
|
2024-12-10 12:46:48 -03:00
|
|
|
}
|
|
|
|
|
|
|
|
chain out {
|
|
|
|
type filter hook output priority filter; policy drop;
|
2024-12-12 22:18:48 -03:00
|
|
|
udp dport @allowed_udp_ports_out accept;
|
2024-12-12 22:23:05 -03:00
|
|
|
oifname "lo" accept;
|
2024-12-10 12:46:48 -03:00
|
|
|
}
|
|
|
|
}
|
2024-12-13 00:49:09 -03:00
|
|
|
|
|
|
|
include "./nat.nft"
|