Difference between revisions of "Simple ruleset for a workstation"

From nftables wiki
Jump to navigation Jump to search
(add flush ruleset)
(remove echo request in IPv6 examples)
 
Line 41: Line 41:


                 # accept neighbour discovery otherwise connectivity breaks
                 # accept neighbour discovery otherwise connectivity breaks
                 icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept
                 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
         }
         }
}
}
Line 64: Line 64:


                 # accept neighbour discovery otherwise IPv6 connectivity breaks
                 # accept neighbour discovery otherwise IPv6 connectivity breaks
                 icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept
                 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept


         }
         }
}
}
</source>
</source>

Latest revision as of 10:33, 12 August 2021

A very simple set of rules that allows you to initiate communications from your workstation to the Internet but restricts any communication initiation to your workstation (that was not initiated by you).

You can load this file with nft -f.

fw.basic

For IPv4 only workstation.

flush ruleset

table ip filter {
     chain input {
          type filter hook input priority 0; policy drop;

          # accept traffic originated from us
          ct state established,related accept

          # accept any localhost traffic
          iif lo accept
     }
}

fw6.basic

For IPv6 only workstation.

flush ruleset

table ip6 filter {
        chain input {
                 type filter hook input priority 0; policy drop;

                 # accept any localhost traffic
                 iif lo accept

                 # accept traffic originated from us
                 ct state established,related accept

                 # accept neighbour discovery otherwise connectivity breaks
                 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
        }
}

fw.inet.basic

For dual-stack IPv4/IPv6 workstation.

flush ruleset

table inet filter {
        chain input {
                 type filter hook input priority 0; policy drop;

                 # accept any localhost traffic
                 iif lo accept

                 # accept traffic originated from us
                 ct state established,related accept

                 # accept neighbour discovery otherwise IPv6 connectivity breaks
                 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept

        }
}