61 lines
1.6 KiB
Plaintext
61 lines
1.6 KiB
Plaintext
#!/usr/bin/nft
|
|
flush ruleset
|
|
|
|
include "./defines.nft"
|
|
include "/var/geoipsets/dbip/nftset/ipv4/*.ipv4"
|
|
|
|
table ip filter {
|
|
set allowed_tcp_ports {
|
|
type inet_service; flags constant;
|
|
elements = {
|
|
$SSH_PORT1, $SSH_PORT2, $DNS_PORT, $HTTP_PORT, $HTTPS_PORT, $SYNCPLAY_PORT,
|
|
$TERRARIA_PORT, $OPENTTD_PORT, $MAINPAGE_PORT, $NEXTCLOUD_PORT, $GITEA_PORT,
|
|
$POSTGRESQL_PORT
|
|
};
|
|
}
|
|
|
|
set allowed_udp_ports_in {
|
|
type inet_service; flags constant;
|
|
elements = { $DNS_PORT, $DHCP_IN_PORT, $OPENVPN_PORT, $FACTORIO_PORT, $OPENTTD_PORT, $CSTRIKE_PORT, $SNMP_POLL_PORT, $SNMP_TRAP_PORT }
|
|
}
|
|
|
|
set allowed_udp_ports_out {
|
|
type inet_service; flags constant;
|
|
elements = { $DNS_PORT, $DHCP_OUT_PORT, $SNMP_POLL_PORT }
|
|
}
|
|
|
|
set ipv4_geo_blacklist {
|
|
type ipv4_addr; flags interval;
|
|
elements = { };
|
|
}
|
|
|
|
chain in {
|
|
type filter hook input priority filter; policy drop;
|
|
ip saddr @ipv4_geo_blacklist drop;
|
|
ct state vmap { invalid : drop, related : accept, established : accept };
|
|
iifname "lo" accept;
|
|
icmp type echo-request accept;
|
|
tcp dport @allowed_tcp_ports accept;
|
|
udp dport @allowed_udp_ports_in accept;
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop;
|
|
comment "this routes vpn traffic";
|
|
ct state related,established accept;
|
|
iifname "tun0" oifname "eth0" accept;
|
|
}
|
|
|
|
chain out {
|
|
type filter hook output priority filter; policy drop;
|
|
ip daddr @ipv4_geo_blacklist drop;
|
|
ct state vmap { invalid : drop, related : accept, established : accept, new : accept };
|
|
udp dport @allowed_udp_ports_out accept;
|
|
oifname "lo" accept;
|
|
icmp type echo-reply accept;
|
|
}
|
|
}
|
|
|
|
include "./nat.nft"
|
|
|