Portál AbcLinuxu, 6. května 2025 23:06
-Povolit VPN. -Zakazat vsechno ostatni.Geoip? Na co jako? Povol co potrebujes, zbytek zahazuj, a neres tak, ok?
#!/usr/sbin/nft -f
flush ruleset
include "/etc/nftables/defines.nft"
include "/etc/nftables/set-intdev.nft"
# The main table
table inet filter {
# include "/etc/nftables/nftables-geoip/geoip-def-all.nft"
# include "/etc/nftables/nftables-geoip/geoip-ipv4.nft"
# include "/etc/nftables/nftables-geoip/geoip-ipv6.nft"
#chain geoip-mark-input {
# type filter hook input priority -1; policy accept;
# meta mark set ip saddr map @geoip4
# meta mark set ip6 saddr map @geoip6
# counter
# }
chain global {
iif lo accept comment "povoleni loopback"
#iif != lo ip daddr 127.0.0.1/8 counter drop
ct state invalid counter drop
ct state established,related counter accept
meta l4proto ipv6-icmp icmpv6 type { echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } counter accept comment "Accept ICMPv6"
meta l4proto icmp icmp type { echo-request, destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } counter accept comment "Accept ICMP"
ip protocol igmp counter accept
udp dport { mdns, domain } counter accept
counter comment "Count any other traffic"
}
include "/etc/nftables/inet-filter-sets.nft"
include "/etc/nftables/inet-filter-chain-local.nft"
include "/etc/nftables/inet-filter-chain-forward.nft"
include "/etc/nftables/inet-filter-chain-nat.nft"
}
Pok se jiz skace do ostatnich retezcu a znich zpet do tabulky inet filter. Zahesovane include s geoip chain geoip mam dle navodu ale jeste neaplikuji. Samotna blokace adres by se provadela az v retezci inet-filter.chain-local.nft:
hain input {
type filter hook input priority 0 ; policy drop;
jump global
# Country geo-blockation rules for input.
#meta mark { $RU, $BY } log prefix "RU,BY_block: " counter drop comment "Block Russia and Belarus public IPs range"
# Allow ssh to firewall for allowed nets.
ip saddr @Allowed_Nets ct state new tcp dport { ssh } meter ssh-meter4 {ip saddr limit rate 10/minute burst 15 packets} log prefix "SSH_IN:" counter accept comment "SSH_In: "
# Allow Wireguard vpn in to firewall.
ct state new udp dport { 51820 } log prefix "WireguardIn: " counter accept comment "WireguardAccessIn"
# Allow Openvpn in to firewall.
ct state new udp dport { openvpn } log prefix "OpenvpnIn: " counter accept comment "OpenvpnAccessIn"
# Allow ntp sync for lan network.
ip saddr { $net_lan, $net_wg, $net_ovpn, $net_dmz } ct state new udp dport { ntp } counter accept comment "NTpSyncLanIn"
# Allow iperf speed test to router for both UDP/TCP packets and from allowed nets.
ip saddr @Allowed_Nets ct state new udp dport { 5201 } counter accept comment "IperfSpeedTest"
ip saddr @Allowed_Nets ct state new tcp dport { 5201 } counter accept comment "IperfSpeedTest"
# Allow DHCP requests/discovery on firewall.
udp sport bootpc udp dport bootps ip saddr 0.0.0.0 ip daddr 255.255.255.255 counter accept comment "Accept DHCPDISCOVER (for DHCP)"
# Allow Netdata for allowed nets.
ip saddr { $net_lan, $net_wg, $net_vlan, $net_ovpn } ct state new tcp dport { 19999 } log prefix "Netdata_In: " counter accept comment "NetdataAccess"
# All other traffic is drop.
counter comment "CountAllOtherTraffic"
}
chain output {
type filter hook output priority 0 ; policy drop;
jump global
# your rules for traffic originated from the firewall itself here
counter accept
}
Toto je retezec kde jdou pravidle na firewall "it self" hned prvni pravidlo by blokovala dane rozsahy (Rusko,Cina). Je to takto providetelne aby to skvencne davalo smysl ?
Dekuji za rady.
Tiskni
Sdílej:
ISSN 1214-1267, (c) 1999-2007 Stickfish s.r.o.