summaryrefslogtreecommitdiff
path: root/hosts/eostre/ruleset.nft
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/eostre/ruleset.nft')
-rw-r--r--hosts/eostre/ruleset.nft101
1 files changed, 101 insertions, 0 deletions
diff --git a/hosts/eostre/ruleset.nft b/hosts/eostre/ruleset.nft
new file mode 100644
index 00000000..7b38a059
--- /dev/null
+++ b/hosts/eostre/ruleset.nft
@@ -0,0 +1,101 @@
1define icmp_protos = {ipv6-icmp, icmp, igmp}
2
3table arp filter {
4 limit lim_arp {
5 rate over 50 mbytes/second burst 50 mbytes
6 }
7
8 chain input {
9 type filter hook input priority filter
10 policy accept
11
12 limit name lim_arp counter drop
13
14 counter
15 }
16
17 chain output {
18 type filter hook output priority filter
19 policy accept
20
21 limit name lim_arp counter drop
22
23 counter
24 }
25}
26
27table inet filter {
28 limit lim_reject {
29 rate over 1000/second burst 1000 packets
30 }
31
32 limit lim_icmp {
33 rate over 50 mbytes/second burst 50 mbytes
34 }
35
36
37 chain forward {
38 type filter hook forward priority filter
39 policy drop
40
41
42 ct state invalid log level debug prefix "drop invalid forward: " counter drop
43
44
45 iifname lo counter accept
46
47
48 limit name lim_reject log level debug prefix "drop forward: " counter drop
49 log level debug prefix "reject forward: " counter
50 meta l4proto tcp ct state new counter reject with tcp reset
51 ct state new counter reject
52
53
54 counter
55 }
56
57 chain input {
58 type filter hook input priority filter
59 policy drop
60
61
62 ct state invalid log level debug prefix "drop invalid input: " counter drop
63
64
65 iifname lo counter accept
66 iif != lo ip daddr 127.0.0.1/8 counter reject
67 iif != lo ip6 daddr ::1/128 counter reject
68
69 meta l4proto $icmp_protos limit name lim_icmp counter drop
70 meta l4proto $icmp_protos counter accept
71
72 tcp dport 22 counter accept
73 udp dport 60000-61000 counter accept
74
75
76 ct state {established, related} counter accept
77
78
79 limit name lim_reject log level debug prefix "drop input: " counter drop
80 log level debug prefix "reject input: " counter
81 meta l4proto tcp ct state new counter reject with tcp reset
82 ct state new counter reject
83
84
85 counter
86 }
87
88 chain output {
89 type filter hook output priority filter
90 policy accept
91
92
93 oifname lo counter accept
94
95 meta l4proto $icmp_protos limit name lim_icmp counter drop
96 meta l4proto $icmp_protos counter accept
97
98
99 counter
100 }
101} \ No newline at end of file