Administrace komentářů

Ahoj, pravidla prikladam. Jen trochu zasnu jak se to tu agresivne resi a radi. Ja nedelam zadny enterprise firewall. Mam pro svuj domaci home lab. Zelezo na kterem to bezi je od Pcengines APU4D4 a debian 11 netinst. Samozrejme pokud bych nechtel nic resit a mit pekne klikaci rozhrani nainstaluji na to pfsense a neresim nic. Ja jdu cestou neco se naucit a pochopit to co bezi na tom podkladu. Tak tady je ten firewall. Mám více modifikovanou struktura dle tohoto:

https://wiki.nftables.org/wiki-nftables/index.php/Classic_perimetral_firewall_example

/etc/nftables.conf slouzi jako globalni rozcestnik.

#!/usr/sbin/nft -f

flush ruleset

include "/etc/nftables/defines.nft"
include "/etc/nftables/set-intdev.nft"

# The main table
table inet filter {
#	include "/etc/nftables/nftables-geoip/geoip-def-all.nft"
#	include "/etc/nftables/nftables-geoip/geoip-ipv4.nft"
#	include "/etc/nftables/nftables-geoip/geoip-ipv6.nft"

#chain geoip-mark-input {
#                type filter hook input priority -1; policy accept;
#		meta mark set ip saddr map @geoip4
#                meta mark set ip6 saddr map @geoip6
#	counter
#        }

	chain global {
		iif lo accept comment "povoleni loopback"
		#iif != lo ip daddr 127.0.0.1/8 counter drop
		ct state invalid counter drop
		ct state established,related counter accept
		meta l4proto ipv6-icmp icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } counter accept comment "Accept ICMPv6"
		meta l4proto icmp icmp type { echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } counter accept comment "Accept ICMP"
		ip protocol igmp counter accept
		udp dport { mdns, domain } counter accept
	counter comment "Count any other traffic"
	}

	include "/etc/nftables/inet-filter-sets.nft"
	include "/etc/nftables/inet-filter-chain-local.nft"
        include "/etc/nftables/inet-filter-chain-forward.nft"
	include "/etc/nftables/inet-filter-chain-nat.nft"
 }

Pok se jiz skace do ostatnich retezcu a znich zpet do tabulky inet filter. Zahesovane include s geoip chain geoip mam dle navodu ale jeste neaplikuji. Samotna blokace adres by se provadela az v retezci inet-filter.chain-local.nft:

hain input {
        type filter hook input priority 0 ; policy drop;
        jump global
	# Country geo-blockation rules for input.
	#meta mark { $RU, $BY } log prefix "RU,BY_block: " counter drop comment "Block Russia and Belarus public IPs range"
	# Allow ssh to firewall for allowed nets.
	ip saddr @Allowed_Nets ct state new tcp dport { ssh } meter ssh-meter4 {ip saddr limit rate 10/minute burst 15 packets} log prefix "SSH_IN:" counter  accept comment "SSH_In: "
	# Allow Wireguard vpn in to firewall.
	ct state new udp dport { 51820 } log prefix "WireguardIn: " counter accept comment "WireguardAccessIn"
	# Allow Openvpn in to firewall.
	ct state new udp dport { openvpn } log prefix "OpenvpnIn: " counter accept comment "OpenvpnAccessIn"
	# Allow ntp sync for lan network.
	ip saddr { $net_lan, $net_wg, $net_ovpn, $net_dmz } ct state new udp dport { ntp } counter accept comment "NTpSyncLanIn" 
	# Allow iperf speed test to router for both UDP/TCP packets and from allowed nets.
	ip saddr @Allowed_Nets ct state new udp dport { 5201 } counter accept comment "IperfSpeedTest"
	ip saddr @Allowed_Nets ct state new tcp dport { 5201 } counter accept comment "IperfSpeedTest"
	# Allow DHCP requests/discovery on firewall.
	udp sport bootpc udp dport bootps ip saddr 0.0.0.0 ip daddr 255.255.255.255 counter accept comment "Accept DHCPDISCOVER (for DHCP)"
	# Allow Netdata for allowed nets.
	ip saddr { $net_lan, $net_wg, $net_vlan, $net_ovpn } ct state new tcp dport { 19999 } log prefix "Netdata_In: " counter accept comment "NetdataAccess"
	# All other traffic is drop.
	counter comment "CountAllOtherTraffic"
}

chain output {
        type filter hook output priority 0 ; policy drop;
        jump global
        # your rules for traffic originated from the firewall itself here
	counter accept
}

Toto je retezec kde jdou pravidle na firewall "it self" hned prvni pravidlo by blokovala dane rozsahy (Rusko,Cina). Je to takto providetelne aby to skvencne davalo smysl ? Dekuji za rady.