Simple ruleset for a server: Difference between revisions
Jump to navigation
Jump to search
(→nftables.conf: no echo-request in neighbour discovery rule) |
(→nftables.conf: missing closing curly brace) |
||
| (2 intermediate revisions by one other user not shown) | |||
| Line 3: | Line 3: | ||
= nftables.conf = | = nftables.conf = | ||
< | <syntaxhighlight lang="bash"> | ||
flush ruleset | flush ruleset | ||
| Line 13: | Line 13: | ||
# This sample accepts them within a certain rate limit: | # This sample accepts them within a certain rate limit: | ||
# | # | ||
# icmp type echo-request limit rate 5/second | # icmp type echo-request limit rate 5/second accept | ||
} | } | ||
| Line 25: | Line 25: | ||
# This sample accepts them within a certain rate limit: | # This sample accepts them within a certain rate limit: | ||
# | # | ||
# icmpv6 type echo-request limit rate 5/second | # icmpv6 type echo-request limit rate 5/second accept | ||
} | } | ||
| Line 57: | Line 57: | ||
# no need to define output chain, default policy is accept if undefined. | # no need to define output chain, default policy is accept if undefined. | ||
</ | } | ||
</syntaxhighlight> | |||
Latest revision as of 18:34, 31 January 2022
Here's a very basic example for a web server, you can load the ruleset file with nft -f.
nftables.conf
flush ruleset
table inet firewall {
chain inbound_ipv4 {
# accepting ping (icmp-echo-request) for diagnostic purposes.
# However, it also lets probes discover this host is alive.
# This sample accepts them within a certain rate limit:
#
# icmp type echo-request limit rate 5/second accept
}
chain inbound_ipv6 {
# accept neighbour discovery otherwise connectivity breaks
#
icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
# accepting ping (icmpv6-echo-request) for diagnostic purposes.
# However, it also lets probes discover this host is alive.
# This sample accepts them within a certain rate limit:
#
# icmpv6 type echo-request limit rate 5/second accept
}
chain inbound {
# By default, drop all traffic unless it meets a filter
# criteria specified by the rules that follow below.
type filter hook input priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }
# Allow loopback traffic.
iifname lo accept
# Jump to chain according to layer 3 protocol using a verdict map
meta protocol vmap { ip : jump inbound_ipv4, ip6 : jump inbound_ipv6 }
# Allow SSH on port TCP/22 and allow HTTP(S) TCP/80 and TCP/443
# for IPv4 and IPv6.
tcp dport { 22, 80, 443} accept
# Uncomment to enable logging of denied inbound traffic
# log prefix "[nftables] Inbound Denied: " counter drop
}
chain forward {
# Drop everything (assumes this device is not a router)
type filter hook forward priority 0; policy drop;
}
# no need to define output chain, default policy is accept if undefined.
}