homemade_firewall/filter.nft

26 lines
508 B
Plaintext
Raw Normal View History

2024-12-10 12:46:48 -03:00
#!/usr/bin/nft
flush ruleset
2024-12-12 22:12:20 -03:00
include "./defines.nft"
2024-12-10 12:46:48 -03:00
table ip filter {
set allowed_tcp_ports {
type inet_service;
flags constant;
elements = { $SSH_PORT1, $SSH_PORT2 };
}
2024-12-10 12:46:48 -03:00
chain in {
type filter hook input priority filter; policy drop;
ct state invalid drop;
ct state {related,established} accept;
tcp dport @allowed_tcp_ports accept;
2024-12-10 12:46:48 -03:00
}
chain forward {
type filter hook forward priority filter; policy drop;
}
chain out {
type filter hook output priority filter; policy drop;
}
}