From d8922d513a35bf5e7d75ea0d812d7dcdb6f2c395 Mon Sep 17 00:00:00 2001
From: Gregor Kleen <gkleen@yggdrasil.li>
Date: Mon, 13 Dec 2021 21:41:10 +0100
Subject: nftables: ...

---
 hosts/surtr/ruleset.nft | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'hosts/surtr')

diff --git a/hosts/surtr/ruleset.nft b/hosts/surtr/ruleset.nft
index f8cadc94..0a9ff530 100644
--- a/hosts/surtr/ruleset.nft
+++ b/hosts/surtr/ruleset.nft
@@ -72,8 +72,6 @@ table inet filter {
     meta l4proto $icmp_protos limit name lim_icmp counter drop
     meta l4proto $icmp_protos counter accept
 
-    ct state {established, related} counter accept
-
     tcp dport 22 counter accept
     meta protocol ip udp dport 51820 counter accept
     meta protocol ip6 udp dport 51821 counter accept
@@ -82,6 +80,8 @@ table inet filter {
     tcp dport 53 counter accept
     udp dport 53 counter accept
 
+    ct state {established, related} counter accept
+
 
     limit name lim_reject log prefix "drop input: " counter drop
     log prefix "reject input: " counter
-- 
cgit v1.2.3