diff options
Diffstat (limited to 'hosts/eos/ruleset.nft')
| -rw-r--r-- | hosts/eos/ruleset.nft | 101 |
1 files changed, 0 insertions, 101 deletions
diff --git a/hosts/eos/ruleset.nft b/hosts/eos/ruleset.nft deleted file mode 100644 index 7b38a059..00000000 --- a/hosts/eos/ruleset.nft +++ /dev/null | |||
| @@ -1,101 +0,0 @@ | |||
| 1 | define icmp_protos = {ipv6-icmp, icmp, igmp} | ||
| 2 | |||
| 3 | table arp filter { | ||
| 4 | limit lim_arp { | ||
| 5 | rate over 50 mbytes/second burst 50 mbytes | ||
| 6 | } | ||
| 7 | |||
| 8 | chain input { | ||
| 9 | type filter hook input priority filter | ||
| 10 | policy accept | ||
| 11 | |||
| 12 | limit name lim_arp counter drop | ||
| 13 | |||
| 14 | counter | ||
| 15 | } | ||
| 16 | |||
| 17 | chain output { | ||
| 18 | type filter hook output priority filter | ||
| 19 | policy accept | ||
| 20 | |||
| 21 | limit name lim_arp counter drop | ||
| 22 | |||
| 23 | counter | ||
| 24 | } | ||
| 25 | } | ||
| 26 | |||
| 27 | table inet filter { | ||
| 28 | limit lim_reject { | ||
| 29 | rate over 1000/second burst 1000 packets | ||
| 30 | } | ||
| 31 | |||
| 32 | limit lim_icmp { | ||
| 33 | rate over 50 mbytes/second burst 50 mbytes | ||
| 34 | } | ||
| 35 | |||
| 36 | |||
| 37 | chain forward { | ||
| 38 | type filter hook forward priority filter | ||
| 39 | policy drop | ||
| 40 | |||
| 41 | |||
| 42 | ct state invalid log level debug prefix "drop invalid forward: " counter drop | ||
| 43 | |||
| 44 | |||
| 45 | iifname lo counter accept | ||
| 46 | |||
| 47 | |||
| 48 | limit name lim_reject log level debug prefix "drop forward: " counter drop | ||
| 49 | log level debug prefix "reject forward: " counter | ||
| 50 | meta l4proto tcp ct state new counter reject with tcp reset | ||
| 51 | ct state new counter reject | ||
| 52 | |||
| 53 | |||
| 54 | counter | ||
| 55 | } | ||
| 56 | |||
| 57 | chain input { | ||
| 58 | type filter hook input priority filter | ||
| 59 | policy drop | ||
| 60 | |||
| 61 | |||
| 62 | ct state invalid log level debug prefix "drop invalid input: " counter drop | ||
| 63 | |||
| 64 | |||
| 65 | iifname lo counter accept | ||
| 66 | iif != lo ip daddr 127.0.0.1/8 counter reject | ||
| 67 | iif != lo ip6 daddr ::1/128 counter reject | ||
| 68 | |||
| 69 | meta l4proto $icmp_protos limit name lim_icmp counter drop | ||
| 70 | meta l4proto $icmp_protos counter accept | ||
| 71 | |||
| 72 | tcp dport 22 counter accept | ||
| 73 | udp dport 60000-61000 counter accept | ||
| 74 | |||
| 75 | |||
| 76 | ct state {established, related} counter accept | ||
| 77 | |||
| 78 | |||
| 79 | limit name lim_reject log level debug prefix "drop input: " counter drop | ||
| 80 | log level debug prefix "reject input: " counter | ||
| 81 | meta l4proto tcp ct state new counter reject with tcp reset | ||
| 82 | ct state new counter reject | ||
| 83 | |||
| 84 | |||
| 85 | counter | ||
| 86 | } | ||
| 87 | |||
| 88 | chain output { | ||
| 89 | type filter hook output priority filter | ||
| 90 | policy accept | ||
| 91 | |||
| 92 | |||
| 93 | oifname lo counter accept | ||
| 94 | |||
| 95 | meta l4proto $icmp_protos limit name lim_icmp counter drop | ||
| 96 | meta l4proto $icmp_protos counter accept | ||
| 97 | |||
| 98 | |||
| 99 | counter | ||
| 100 | } | ||
| 101 | } \ No newline at end of file | ||