Created
January 20, 2014 08:39
-
-
Save Mic92/8516850 to your computer and use it in GitHub Desktop.
My personal NFTables setup, USAGE:
nft -f nfttables.rules
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #IPv4 filtering | |
| # input | |
| delete rule filter input | |
| add rule filter input ct state established accept | |
| add rule filter input ct state related accept | |
| add rule filter input meta iif lo accept | |
| add rule filter input tcp dport ssh counter packets 0 bytes 0 accept | |
| add rule filter input tcp dport https counter packets 0 bytes 0 accept | |
| add rule filter input tcp dport https counter packets 0 bytes 0 accept | |
| add rule filter input counter packets 5 bytes 5 log drop | |
| # forwarding | |
| delete rule filter forward | |
| # output | |
| delete rule filter output | |
| add rule filter output ct state established accept | |
| add rule filter output ct state related accept | |
| add rule filter output meta oif lo accept | |
| add rule filter output ct state new counter packets 0 bytes 0 accept | |
| #IPv6 filtering | |
| # input | |
| delete rule ip6 filter input | |
| add rule ip6 filter input ct state established accept | |
| add rule ip6 filter input ct state related accept | |
| add rule ip6 filter input meta iif lo accept | |
| add rule ip6 filter input tcp dport ssh counter packets 0 bytes 0 accept | |
| add rule ip6 filter input tcp dport http counter packets 0 bytes 0 accept | |
| add rule ip6 filter input tcp dport https counter packets 0 bytes 0 accept | |
| add rule ip6 filter input icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept | |
| add rule ip6 filter input counter packets 5 bytes 5 log drop | |
| # forwarding | |
| delete rule ip6 filter forward | |
| # output | |
| delete rule ip6 filter output | |
| add rule ip6 filter output ct state established accept | |
| add rule ip6 filter output ct state related accept | |
| add rule ip6 filter output meta oif lo accept | |
| add rule ip6 filter output ct state new counter packets 0 bytes 0 accept |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment