162 lines
5.6 KiB
Plaintext
162 lines
5.6 KiB
Plaintext
#!/sbin/nft -f
|
|
|
|
table inet firewall
|
|
delete table inet firewall
|
|
|
|
table inet firewall {
|
|
chain prerouting {
|
|
type filter hook prerouting priority mangle; policy drop;
|
|
|
|
iifname != ppp0 accept comment "only care about ppp0"
|
|
|
|
ip saddr 192.168.43.0/24 counter accept
|
|
|
|
udp dport > 32767 counter accept
|
|
|
|
# Permit established and related connections
|
|
ct state established,related \
|
|
accept \
|
|
comment "Permit established/related connections"
|
|
|
|
# Permit inbound IKEv2 traffic
|
|
udp dport { 500, 4500 } \
|
|
counter \
|
|
accept \
|
|
comment "Permit inbound IKEv2 traffic"
|
|
|
|
# Permit inbound k3s traffic
|
|
tcp dport { 6443 } \
|
|
counter \
|
|
accept \
|
|
comment "Permit inbound k3s traffic"
|
|
|
|
# Permit inbound traceroute UDP ports but limit to 500 PPS
|
|
udp dport 33434-33524 \
|
|
limit rate 500/second \
|
|
counter \
|
|
accept \
|
|
comment "Permit inbound UDP traceroute limited to 500 PPS"
|
|
|
|
# Permit inbound SSH
|
|
tcp dport { 22, 2456, 24567 } \
|
|
counter \
|
|
accept \
|
|
comment "Permit inbound SSH connections"
|
|
|
|
# Permit aria2 listen port
|
|
meta l4proto { tcp, udp } \
|
|
th dport 16881 \
|
|
counter \
|
|
accept \
|
|
comment "Permit aria2 listen port"
|
|
|
|
# Log and drop new TCP non-SYN packets
|
|
tcp flags != syn ct state new \
|
|
limit rate 100/minute burst 150 packets \
|
|
log prefix "IN - New !SYN: " \
|
|
comment "Rate limit logging for new connections that do not have the SYN TCP flag set"
|
|
tcp flags != syn ct state new \
|
|
counter \
|
|
drop \
|
|
comment "Drop new connections that do not have the SYN TCP flag set"
|
|
|
|
# Log and drop TCP packets with invalid fin/syn flag set
|
|
tcp flags & (fin|syn) == (fin|syn) \
|
|
limit rate 100/minute burst 150 packets \
|
|
log prefix "IN - TCP FIN|SIN: " \
|
|
comment "Rate limit logging for TCP packets with invalid fin/syn flag set"
|
|
tcp flags & (fin|syn) == (fin|syn) \
|
|
counter \
|
|
drop \
|
|
comment "Drop TCP packets with invalid fin/syn flag set"
|
|
|
|
# Log and drop TCP packets with invalid syn/rst flag set
|
|
tcp flags & (syn|rst) == (syn|rst) \
|
|
limit rate 100/minute burst 150 packets \
|
|
log prefix "IN - TCP SYN|RST: " \
|
|
comment "Rate limit logging for TCP packets with invalid syn/rst flag set"
|
|
tcp flags & (syn|rst) == (syn|rst) \
|
|
counter \
|
|
drop \
|
|
comment "Drop TCP packets with invalid syn/rst flag set"
|
|
|
|
# Log and drop invalid TCP flags
|
|
tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \
|
|
limit rate 100/minute burst 150 packets \
|
|
log prefix "IN - FIN:" \
|
|
comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) < (fin)"
|
|
tcp flags & (fin|syn|rst|psh|ack|urg) < (fin) \
|
|
counter \
|
|
drop \
|
|
comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) < (fin)"
|
|
|
|
# Log and drop invalid TCP flags
|
|
tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \
|
|
limit rate 100/minute burst 150 packets \
|
|
log prefix "IN - FIN|PSH|URG:" \
|
|
comment "Rate limit logging for invalid TCP flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)"
|
|
tcp flags & (fin|syn|rst|psh|ack|urg) == (fin|psh|urg) \
|
|
counter \
|
|
drop \
|
|
comment "Drop TCP packets with flags (fin|syn|rst|psh|ack|urg) == (fin|psh|urg)"
|
|
|
|
# Drop traffic with invalid connection state
|
|
ct state invalid \
|
|
limit rate 100/minute burst 150 packets \
|
|
log flags all prefix "IN - Invalid: " \
|
|
comment "Rate limit logging for traffic with invalid connection state"
|
|
ct state invalid \
|
|
counter \
|
|
drop \
|
|
comment "Drop traffic with invalid connection state"
|
|
|
|
# Permit IPv4 ping/ping responses but rate limit to 2000 PPS
|
|
ip protocol icmp icmp type { echo-reply, echo-request } \
|
|
limit rate 2000/second \
|
|
counter \
|
|
accept \
|
|
comment "Permit inbound IPv4 echo (ping) limited to 2000 PPS"
|
|
|
|
# Permit all other inbound IPv4 ICMP
|
|
ip protocol icmp \
|
|
counter \
|
|
accept \
|
|
comment "Permit all other IPv4 ICMP"
|
|
|
|
# Permit IPv6 ping/ping responses but rate limit to 2000 PPS
|
|
icmpv6 type { echo-reply, echo-request } \
|
|
limit rate 2000/second \
|
|
counter \
|
|
accept \
|
|
comment "Permit inbound IPv6 echo (ping) limited to 2000 PPS"
|
|
|
|
## Permit all other inbound IPv6 ICMP
|
|
meta l4proto { icmpv6 } \
|
|
counter \
|
|
accept \
|
|
comment "Permit all other IPv6 ICMP"
|
|
|
|
# Log any unmatched traffic but rate limit logging to a maximum of 60 messages/minute
|
|
# The default policy will be applied to unmatched traffic
|
|
limit rate 60/minute burst 100 packets \
|
|
log prefix "IN - Drop: " \
|
|
comment "Log any unmatched traffic"
|
|
|
|
# Count the unmatched traffic
|
|
counter \
|
|
comment "Count any unmatched traffic"
|
|
}
|
|
}
|
|
|
|
table inet ppp
|
|
delete table inet ppp
|
|
|
|
table inet ppp {
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100; policy accept;
|
|
oifname != "ppp0" return
|
|
meta l4proto { tcp, udp } ip saddr 10.10.0.0/16 counter masquerade
|
|
meta l4proto { tcp, udp } ip6 saddr fddd:dddd:dddd:dddd::/64 counter masquerade
|
|
}
|
|
}
|