Difference between revisions of "Simple ruleset for a workstation"

From nftables wiki
Jump to navigation Jump to search
(use policy and more comments)
(add flush ruleset)
Line 1: Line 1:
A very simple set of rules that allows you to initiate communications from your workstation to the Internet but restricts any communication initiation to your workstation (that was not initiated by you).
A very simple set of rules that allows you to initiate communications from your workstation to the Internet but restricts any communication initiation to your workstation (that was not initiated by you).
You can load this file with nft -f.


= fw.basic =
= fw.basic =
Line 6: Line 8:


<source lang="bash">
<source lang="bash">
flush ruleset
table ip filter {
table ip filter {
     chain input {
     chain input {
Line 24: Line 28:


<source lang="bash">
<source lang="bash">
flush ruleset
table ip6 filter {
table ip6 filter {
         chain input {
         chain input {
Line 45: Line 51:


<source lang="bash">
<source lang="bash">
flush ruleset
table inet filter {
table inet filter {
         chain input {
         chain input {

Revision as of 06:14, 11 August 2021

A very simple set of rules that allows you to initiate communications from your workstation to the Internet but restricts any communication initiation to your workstation (that was not initiated by you).

You can load this file with nft -f.

fw.basic

For IPv4 only workstation.

flush ruleset

table ip filter {
     chain input {
          type filter hook input priority 0; policy drop;

          # accept traffic originated from us
          ct state established,related accept

          # accept any localhost traffic
          iif lo accept
     }
}

fw6.basic

For IPv6 only workstation.

flush ruleset

table ip6 filter {
        chain input {
                 type filter hook input priority 0; policy drop;

                 # accept any localhost traffic
                 iif lo accept

                 # accept traffic originated from us
                 ct state established,related accept

                 # accept neighbour discovery otherwise connectivity breaks
                 icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept
        }
}

fw.inet.basic

For dual-stack IPv4/IPv6 workstation.

flush ruleset

table inet filter {
        chain input {
                 type filter hook input priority 0; policy drop;

                 # accept any localhost traffic
                 iif lo accept

                 # accept traffic originated from us
                 ct state established,related accept

                 # accept neighbour discovery otherwise IPv6 connectivity breaks
                 icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept

        }
}