You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
41 lines
1.3 KiB
41 lines
1.3 KiB
#!/usr/sbin/nft -f |
|
|
|
flush ruleset |
|
|
|
table inet filter { |
|
chain input { |
|
type filter hook input priority 0; policy drop; |
|
iif lo accept |
|
ct state established,related accept |
|
# Log and drop invalid packets |
|
ct state invalid log prefix "INVALID: " level warn drop |
|
# Log and accept SSH |
|
tcp dport 22 ct state new log prefix "SSH: " level info accept |
|
# Allow web traffic (no logging to reduce volume) |
|
#tcp dport { 80, 443 } accept |
|
# Log everything else that reaches the end (default drop) |
|
log prefix "INPUT DROP: " level warn |
|
} |
|
|
|
chain forward { |
|
type filter hook forward priority 0; policy drop; |
|
|
|
log prefix "FORWARD DROP: " level warn |
|
} |
|
|
|
chain output { |
|
type filter hook output priority 0; policy accept; |
|
# dns request |
|
udp dport 53 log prefix "DNS:" level info |
|
# accept local connection |
|
ip daddr 192.168.122.1 counter accept |
|
ip daddr 192.168.0.253 counter accept |
|
ip daddr 192.168.0.254 counter accept |
|
# counter output packets |
|
counter comment "Count accepted packets" |
|
# not logging established |
|
ct state established,related accept |
|
# Log and accept output packets |
|
log prefix "OUTPUT:" level info flags skuid accept |
|
} |
|
} |