35 lines
898 B
Text
35 lines
898 B
Text
#!/usr/sbin/nft -f
|
|
#
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
# accept any localhost traffic
|
|
iif lo counter accept
|
|
iifname "br-*" counter accept
|
|
|
|
# accept icmp
|
|
ip protocol icmp counter accept
|
|
ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded,
|
|
parameter-problem, echo-request, mld-listener-query,
|
|
nd-router-solicit, nd-router-advert, nd-neighbor-solicit,
|
|
nd-neighbor-advert } counter accept
|
|
|
|
# accept traffic originated from us
|
|
ct state established counter accept
|
|
# silently drop invalid packets
|
|
ct state invalid counter drop
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
}
|
|
chain output {
|
|
type filter hook output priority 0;
|
|
}
|
|
}
|
|
|
|
# include all the other files that may be deployed by puppet
|
|
include "/etc/nftables/conf.d/*.nft"
|