47 lines
1.1 KiB
Django/Jinja
47 lines
1.1 KiB
Django/Jinja
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
set home_net {
|
|
type ipv4_addr
|
|
flags interval
|
|
comment "Home subnet"
|
|
elements = {100.222.5.0/24}
|
|
}
|
|
set iot_net {
|
|
type ipv4_addr
|
|
flags interval
|
|
comment "iOT subnet"
|
|
elements = {100.222.6.0/24}
|
|
}
|
|
set vpn_net {
|
|
type ipv4_addr
|
|
flags interval
|
|
comment "iOT subnet"
|
|
elements = {100.222.11.0/24}
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
|
|
iif lo accept comment "Accept any localhost trafic"
|
|
ct state invalid drop comment "Drop invalid connection"
|
|
fib daddr . iif type != {local, broadcast, multicast} drop
|
|
ct state { established, related } accept
|
|
|
|
#meta l4proto { icmp, ipv6-icmp } accept comment "Accept ICMP"
|
|
|
|
tcp dport 22 accept comment "Allow ssh connection from home subnet"
|
|
ip saddr @vpn_net tcp dport 53 accept comment "Allow ssh connection from home subnet"
|
|
|
|
ip saddr @vpn_net udp dport 53 accept comment "Allow ssh connection from home subnet"
|
|
udp dport {{ wireguard_port }} accept comment "Wireguard port"
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority filter;
|
|
}
|
|
chain output {
|
|
type filter hook output priority filter;
|
|
}
|
|
} |