diff options
author | Kenny Ballou <kb@devnulllabs.io> | 2022-05-30 14:49:45 -0600 |
---|---|---|
committer | Kenny Ballou <kb@devnulllabs.io> | 2022-05-30 14:49:45 -0600 |
commit | 83c77b01c51f6c13a762ca75259a6db865e233f8 (patch) | |
tree | 3cfa778341857951647cabb4ff77bf7b91ff899f /systems/bard | |
parent | 29ab35c35d779955fdb2e5c37572c74789e1921d (diff) | |
download | dotfiles-83c77b01c51f6c13a762ca75259a6db865e233f8.tar.gz dotfiles-83c77b01c51f6c13a762ca75259a6db865e233f8.tar.xz |
systems|homes: add bard
Add bard system
Signed-off-by: Kenny Ballou <kb@devnulllabs.io>
Diffstat (limited to 'systems/bard')
-rw-r--r-- | systems/bard/nftables-rules.nft | 56 |
1 files changed, 56 insertions, 0 deletions
diff --git a/systems/bard/nftables-rules.nft b/systems/bard/nftables-rules.nft new file mode 100644 index 00000000..46c2ae2a --- /dev/null +++ b/systems/bard/nftables-rules.nft @@ -0,0 +1,56 @@ +table inet filter { + chain input { + type filter hook input priority 0; policy drop; + ct state invalid counter drop comment "drop invalid packets" + ct state established,related counter accept comment "accept related connections" + iif lo counter accept + iif != lo ip daddr 127.0.0.1/8 counter drop + iif != lo ip6 daddr ::1/128 counter drop + ip protocol icmp counter accept + ip6 nexthdr ipv6-icmp counter accept + udp dport domain ip saddr 172.16.0.0/12 counter accept + tcp dport ssh counter accept + tcp dport 3000 ip saddr 127.0.0.1/8 counter accept + tcp dport 8000 ip saddr 127.0.0.1/8 counter accept + tcp dport 8080 ip saddr { 127.0.0.1/8, 10.0.0.0/8 } counter accept + tcp dport http-alt ip saddr { 127.0.0.1/8, 10.0.0.0/8 } counter accept + counter + } + + chain forward { + type filter hook forward priority 0; policy drop; + ct state established,related counter accept + counter + } + + chain output { + type filter hook output priority 0; policy drop; + ct state established,related counter accept + icmp type echo-request counter accept + icmp type echo-reply counter accept + ip daddr 127.0.0.0/8 counter accept + ip6 daddr ::1 counter accept + udp dport domain counter accept + tcp dport 853 counter accept comment "DNS over TLS" + udp dport 853 counter accept comment "DNS over TLS" + tcp dport http counter accept + tcp dport https counter accept + udp dport https counter accept + tcp dport ssh counter accept + tcp dport bootps counter accept + udp dport bootps counter accept + tcp dport ntp counter accept + udp dport ntp counter accept + tcp dport nntps counter accept + udp dport nntps counter accept + tcp dport rsync counter accept + udp dport rsync counter accept + tcp dport 8000 counter accept + tcp dport http-alt counter accept + tcp dport 2049 ip daddr 10.0.0.0/8 counter accept comment "NFS" + udp dport 2049 ip daddr 10.0.0.0/8 counter accept comment "NFS" + tcp dport 20048 ip daddr 10.0.0.0/8 counter accept comment "NFS" + udp dport 20048 ip daddr 10.0.0.0/8 counter accept comment "NFS" + counter + } +} |