41 lines
931 B
Text
41 lines
931 B
Text
# /etc/nftables.conf - Mentalnet GNU/Linux firewall
|
|
# Loaded by /etc/init.d/S35nftables at boot. Edit and re-run:
|
|
# nft -f /etc/nftables.conf
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
# loopback
|
|
iifname "lo" accept
|
|
|
|
# established and related connections
|
|
ct state established,related accept
|
|
|
|
# DHCP client replies
|
|
udp sport 67 udp dport 68 accept
|
|
|
|
# ICMP (ping et al.)
|
|
ip protocol icmp accept
|
|
ip6 nexthdr icmpv6 accept
|
|
|
|
# services: SSH, HTTP
|
|
tcp dport 22 accept
|
|
tcp dport 80 accept
|
|
|
|
# log and reject everything else (rate-limited: goes to
|
|
# syslog, not the TTY - see /etc/sysctl.conf)
|
|
limit rate 1/minute log prefix "nft-drop: " counter
|
|
counter reject with icmpx type port-unreachable
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0; policy accept;
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority 0; policy accept;
|
|
}
|
|
}
|