define icmp_protos = { ipv6-icmp, icmp, igmp } table arp filter { limit lim_arp_local { rate over 50 mbytes/second burst 50 mbytes } limit lim_arp_dsl { rate over 1400 kbytes/second burst 1400 kbytes } chain input { type filter hook input priority filter policy accept iifname != dsl limit name lim_arp_local counter drop iifname dsl limit name lim_arp_dsl counter drop counter } chain output { type filter hook output priority filter policy accept oifname != dsl limit name lim_arp_local counter drop oifname dsl limit name lim_arp_dsl counter drop counter } } table inet filter { limit lim_reject { rate over 1000/second burst 1000 packets } limit lim_icmp_local { rate over 50 mbytes/second burst 50 mbytes } limit lim_icmp_dsl { rate over 1400 kbytes/second burst 1400 kbytes } chain forward_icmp_accept { oifname dsl limit name lim_icmp_dsl counter drop iifname dsl limit name lim_icmp_dsl counter drop oifname != dsl limit name lim_icmp_local counter drop iifname != dsl limit name lim_icmp_local counter drop counter accept } chain forward { type filter hook forward priority filter policy drop ct state invalid log prefix "drop invalid forward: " counter drop iifname lo counter accept oifname {lan, dsl} meta l4proto $icmp_protos jump forward_icmp_accept iifname lan oifname dsl counter accept iifname dsl oifname lan ct state {established, related} counter accept limit name lim_reject log prefix "drop forward: " counter drop log prefix "reject forward: " counter meta l4proto tcp ct state new counter reject with tcp reset ct state new counter reject counter } chain input { type filter hook input priority filter policy drop ct state invalid log prefix "drop invalid input: " counter drop iifname lo counter accept iif != lo ip daddr 127.0.0.1/8 counter reject iif != lo ip6 daddr ::1/128 counter reject iifname dsl meta l4proto $icmp_protos limit name lim_icmp_dsl counter drop iifname != dsl meta l4proto $icmp_protos limit name lim_icmp_local counter drop meta l4proto $icmp_protos counter accept tcp dport 22 counter accept udp dport 60001-61000 counter accept iifname lan tcp dport 53 counter accept iifname lan udp dport 53 counter accept meta protocol ip udp dport 51820 counter accept meta protocol ip6 udp dport 51821 counter accept iifname "yggdrasil-wg-*" meta l4proto gre counter accept iifname dsl meta protocol ip6 udp dport 546 udp sport 547 counter accept iifname mgmt udp dport 123 counter accept iifname {lan, mgmt} udp dport 67 counter accept iifname lan udp dport { 137, 138, 3702 } counter accept iifname lan tcp dport { 445, 139, 5357 } counter accept iifname yggdrasil tcp dport 80 counter accept ct state {established, related} counter accept limit name lim_reject log prefix "drop input: " counter drop log prefix "reject input: " counter meta l4proto tcp ct state new counter reject with tcp reset ct state new counter reject counter } chain output { type filter hook output priority filter policy accept oifname lo counter accept oifname dsl meta l4proto $icmp_protos limit name lim_icmp_dsl counter drop oifname != dsl meta l4proto $icmp_protos limit name lim_icmp_local counter drop meta l4proto $icmp_protos counter accept counter } } table ip nat { chain postrouting { type nat hook postrouting priority srcnat policy accept oifname dsl counter masquerade } } table ip mss_clamp { chain postrouting { type filter hook postrouting priority mangle policy accept oifname dsl tcp flags & (syn|rst) == syn counter tcp option maxseg size set rt mtu } }