43 lines
904 B
Plaintext
43 lines
904 B
Plaintext
#!/usr/bin/nft
|
|
flush ruleset
|
|
|
|
include "./defines.nft"
|
|
|
|
table ip filter {
|
|
set allowed_tcp_ports {
|
|
type inet_service;
|
|
flags constant;
|
|
elements = { $SSH_PORT1, $SSH_PORT2, $DNS_PORT, $HTTP_PORT, $HTTPS_PORT };
|
|
}
|
|
|
|
set allowed_udp_ports_in {
|
|
type inet_service;
|
|
flags constant;
|
|
elements = { $DNS_PORT, $DHCP_IN_PORT }
|
|
}
|
|
|
|
set allowed_udp_ports_out {
|
|
type inet_service;
|
|
flags constant;
|
|
elements = { $DNS_PORT, $DHCP_OUT_PORT }
|
|
}
|
|
|
|
chain in {
|
|
type filter hook input priority filter; policy drop;
|
|
ct state invalid drop;
|
|
ct state {related,established} accept;
|
|
iifname "lo" accept;
|
|
tcp dport @allowed_tcp_ports accept;
|
|
udp dport @allowed_udp_ports_in accept;
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop;
|
|
}
|
|
|
|
chain out {
|
|
type filter hook output priority filter; policy drop;
|
|
udp dport @allowed_udp_ports_out accept;
|
|
oifname "lo" accept;
|
|
}
|
|
}
|