Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Example nftables.conf
#!/usr/sbin/nft -f
#
# This config was adapted from various sources.
#
# Use at your own risk. Learn what each rule does
# prior to implementing in your environment.
#
flush ruleset
# Here we're defining two groups of fictitious IP ranges
# and then combining them in a second, single group.
# This is just to illustrate how you can use nftables
# to define variables and some interesting ways they
# can be combined into your ruleset.
define CDN_EDGE = {
192.168.1.1,
10.0.0.0/8
}
define CDN_MONITORS = {
192.168.1.10,
192.168.1.20
}
define CDN = {
$CDN_EDGE,
$CDN_MONITORS
}
table inet firewall {
chain inbound {
# By default, drop all traffic unless it meets
# a filter criteria specified by the following rules.
type filter hook input priority 0; policy drop;
# --- GENERAL TRAFFIC --------------------------------------------------
# Allow traffic from established and related packets.
ct state established,related accept
# Drop invalid packets.
ct state invalid drop
# Allow loopback traffic.
iifname lo accept
# Allow all ICMP and IGMP traffic, but enforce a rate limit
# to help prevent some types of flood attacks.
ip protocol icmp limit rate 4/second accept
ip6 nexthdr ipv6-icmp limit rate 4/second accept
ip protocol igmp limit rate 4/second accept
# --- SPECIFIC TRAFFIC -------------------------------------------------
# Allow SSH on port 22.
tcp dport 22 accept
# Allow HTTP(S).
# -- From anywhere
tcp dport { http, https } accept
udp dport { http, https } accept
# -- From approved IP ranges only
# tcp dport { http, https } ip saddr $CDN accept
# udp dport { http, https } ip saddr $CDN accept
# Allow Jekyll dev traffic on port 4000.
tcp dport 4000 accept
# Allow Hugo dev traffic on port 1313.
tcp dport 1313 accept
# Logging
# log prefix "[nftables] Inbound Denied: " flags all counter drop
}
chain forward {
# Drop everything (if not a router)
type filter hook forward priority 0; policy drop;
# Uncomment to enable logging
# log prefix "[nftables] Forward Denied: " flags all counter drop
}
chain outbound {
# Allow all outbound traffic
type filter hook output priority 0; policy accept;
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.