celso
/
homemade_firewall
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

added dns and dhcp services and sets for incoming and outcoming udp traffic

This commit is contained in:
celso 2024-12-12 22:18:48 -03:00
parent 7265c2ae20
commit ca58857af1
2 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
defines.nft
View File

@ -1,3 +1,6 @@
# services
define SSH_PORT1 = 22 define SSH_PORT1 = 22
define SSH_PORT2 = 8022 define SSH_PORT2 = 8022
define DNS_PORT = 53
define DHCP_IN_PORT = 67
define DHCP_OUT_PORT = 68

17
filter.nft
View File

@ -7,13 +7,27 @@ table ip filter {
set allowed_tcp_ports { set allowed_tcp_ports {
type inet_service; type inet_service;
flags constant; flags constant;
elements = { $SSH_PORT1, $SSH_PORT2 }; elements = { $SSH_PORT1, $SSH_PORT2, $DNS_PORT };
} }
set allowed_udp_ports_in {
type inet_service;
flags constant;
elements = { $DNS_PORT, $DHCP_IN_PORT }
}
set allowed_udp_ports_out {
type inet_service;
flags constant;
elements = { $DNS_PORT, $DHCP_OUT_PORT }
}
chain in { chain in {
type filter hook input priority filter; policy drop; type filter hook input priority filter; policy drop;
ct state invalid drop; ct state invalid drop;
ct state {related,established} accept; ct state {related,established} accept;
tcp dport @allowed_tcp_ports accept; tcp dport @allowed_tcp_ports accept;
udp dport @allowed_udp_ports_in accept;
} }
chain forward { chain forward {
type filter hook forward priority filter; policy drop; type filter hook forward priority filter; policy drop;
@ -21,5 +35,6 @@ table ip filter {
chain out { chain out {
type filter hook output priority filter; policy drop; type filter hook output priority filter; policy drop;
udp dport @allowed_udp_ports_out accept;
} }
} }