linuxpld

Basic firewall / network router using Gentoo Linux.

After compiling the 4.19.66-gentoo kernel, udev renamed the network interfaces of my home linux Router / Firewall and my iptables setup stopped working due ip-conntrack kernel deprecations. I decided to move over to nftables, the new packet classification framework that replaces the existing {ip,ip6,arp,eb} tables infrastructure.

Even though nftables has been in the Linux kernel since 2014, the documentation is extremely sparse. As such this gist :)

Subjectively, using nftables setting up connections to my machine seems to be more responsive compared to using iptables. Connections seem to be made more quickly and ssh-ing into my machine seems more responsive. There always used to be a bit of a lag when I was using iptables, not anymore.

Preperations

linuxpld

# Fail2Ban filter for unsuccesfull MSSQL authentication attempts

[INCLUDES]

# Read common prefixes. If any customizations available -- read them from
# common.local
before = common.conf

[Definition]

linuxpld

Manually create a Fail2Ban jail using fail2ban-client (pre-0.10)

N.B. any syntax / function changes made within fail2ban-client will alter the commands used. The commands used here worked with versions 0.8.6-3wheezy3 and 0.8.13-1. 0.9 may or may not work exactly using the below.

For anyone visiting this and stuck on a version pre 0.10 where you want to add a jail but do not want run reload (which pre 0.10 stops and starts all enabled jails as well as reparsing the config

linuxpld

<?php
// Test default memcached server. Load, then refresh.
if (class_exists('Memcache')) {
    $meminstance = new Memcache();
} else {
    $meminstance = new Memcached();
}

$meminstance->addServer("127.0.0.1",11211);

linuxpld

[root@server02 network-scripts]# cat ifcfg-enp14s0
DEVICE=enp14s0
TYPE=Ethernet
BOOTPROTO=none
ONBOOT=yes
NM_CONTROLLED=no

[root@server02 network-scripts]# cat ifcfg-enp14s0.35
DEVICE=enp14s0.35
TYPE=Ethernet

linuxpld

<?php

/**
 * @license MIT License
 * @copyright maartendekeizer
 */

$memcached = new Memcached();
$memcached->addServer('127.0.0.1', 11211);

linuxpld

LUKS crypt

In this guide, I'm going to setup a keyfile-encrypted LUKS partition. I will be using a single, max-size partition on a single physical device. My physical device is located at /dev/sde

partition the physical device

parted /dev/sde

linuxpld

acl is_static path -i -m beg /static/

linuxpld

# Configuration file for runtime kernel parameters.
# See sysctl.conf(5) for more information.

# See also http://www.nateware.com/linux-network-tuning-for-2013.html for
# an explanation about some of these parameters, and instructions for
# a few other tweaks outside this file.

# See evil packets in your logs.
net.ipv4.conf.all.log_martians = 1

linuxpld

# ------------------------------------------------
# Config files are located in /etc/wireguard/wg0
# ------------------------------------------------

# ---------- Server Config ----------
[Interface]
Address = 10.10.0.1/24 # IPV4 CIDR 
Address = fd86:ea04:1111::1/64 # IPV6 CIDR 
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # Add forwarding when VPN is started
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE # Remove forwarding when VPN is shutdown