celso/homemade_firewall
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

added HLS, added iperf to udp, added argent and its NAT rule

Browse Source
This commit is contained in:
celso 2026-04-02 19:04:24 -03:00
parent 72a1035907
commit 25299fc6e9
3 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
defines.nft
View File

@ -9,18 +9,20 @@ define HTTPS_PORT = 443
define RPCBIND_PORT = 111 define RPCBIND_PORT = 111
define NFS_PORT = 2049 define NFS_PORT = 2049
define MOUNTD_PORT = 32767 define MOUNTD_PORT = 32767
define HLS_PORT = 1935
define SYNCPLAY_PORT = 60000 define SYNCPLAY_PORT = 60000
define TERRARIA_PORT = 7777 define TERRARIA_PORT = 7777
define MAINPAGE_PORT = 3000 define MAINPAGE_PORT = 3000
define NEXTCLOUD_PORT = 3001 define NEXTCLOUD_PORT = 3001
define GITEA_PORT = 3002 define GITEA_PORT = 3002
define IPERF_PORT = 5201 define MARIADB_PORT = 3306
define MARIADB_PORT = 3096 define ARGENT_PORT = 53306
define POSTGRESQL_PORT = 5432 define POSTGRESQL_PORT = 5432
# TCP and UDP services (needs to go in both sets) # TCP and UDP services (needs to go in both sets)
define DNS_PORT = 53 define DNS_PORT = 53
define OPENTTD_PORT = 3979 define OPENTTD_PORT = 3979
define IPERF_PORT = 5201
# UDP only services # UDP only services
define DHCP_IN_PORT = 67 define DHCP_IN_PORT = 67

7
filter.nft
View File

@ -10,18 +10,19 @@ table ip filter {
elements = { elements = {
$SSH_PORT1, $SSH_PORT2, $DNS_PORT, $HTTP_PORT, $HTTPS_PORT, $SYNCPLAY_PORT, $SSH_PORT1, $SSH_PORT2, $DNS_PORT, $HTTP_PORT, $HTTPS_PORT, $SYNCPLAY_PORT,
$TERRARIA_PORT, $OPENTTD_PORT, $MAINPAGE_PORT, $NEXTCLOUD_PORT, $GITEA_PORT, $TERRARIA_PORT, $OPENTTD_PORT, $MAINPAGE_PORT, $NEXTCLOUD_PORT, $GITEA_PORT,
$POSTGRESQL_PORT, $RPCBIND_PORT, $MOUNTD_PORT, $NFS_PORT, $MARIADB_PORT, $IPERF_PORT $POSTGRESQL_PORT, $RPCBIND_PORT, $MOUNTD_PORT, $NFS_PORT, $MARIADB_PORT,
$HLS_PORT, $IPERF_PORT, $ARGENT_PORT
}; };
} }
set allowed_udp_ports_in { set allowed_udp_ports_in {
type inet_service; flags constant; type inet_service; flags constant;
elements = { $DNS_PORT, $DHCP_IN_PORT, $OPENVPN_PORT, $FACTORIO_PORT, $OPENTTD_PORT, $CSTRIKE_PORT, $SNMP_POLL_PORT, $SNMP_TRAP_PORT }; elements = { $DNS_PORT, $DHCP_IN_PORT, $OPENVPN_PORT, $FACTORIO_PORT, $OPENTTD_PORT, $CSTRIKE_PORT, $SNMP_POLL_PORT, $SNMP_TRAP_PORT, $IPERF_PORT };
} }
set allowed_udp_ports_out { set allowed_udp_ports_out {
type inet_service; flags constant; type inet_service; flags constant;
elements = { $DNS_PORT, $DHCP_OUT_PORT, $SNMP_POLL_PORT }; elements = { $DNS_PORT, $DHCP_OUT_PORT, $SNMP_POLL_PORT, $IPERF_PORT };
} }
set ipv4_geo_blacklist { set ipv4_geo_blacklist {

1
nat.nft
View File

@ -2,6 +2,7 @@ table nat {
chain prerouting { chain prerouting {
type nat hook prerouting priority 0; type nat hook prerouting priority 0;
comment "this is necessary even if empty"; comment "this is necessary even if empty";
tcp dport $ARGENT_EXTERNAL_PORT redirect to $MARIADB_PORT;
} }
chain postrouting { chain postrouting {