40 lines
921 B
Django/Jinja
40 lines
921 B
Django/Jinja
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
set home_net {
|
|
type ipv4_addr
|
|
flags interval
|
|
comment "Home subnet"
|
|
elements = {100.222.5.0/24}
|
|
}
|
|
set iot_net {
|
|
type ipv4_addr
|
|
flags interval
|
|
comment "iOT subnet"
|
|
elements = {100.222.6.0/24}
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
|
|
iif lo accept comment "Accept any localhost trafic"
|
|
ct state invalid drop comment "Drop invalid connection"
|
|
fib daddr . iif type != {local, broadcast, multicast} drop
|
|
ct state { established, related } accept
|
|
|
|
#meta l4proto { icmp, ipv6-icmp } accept comment "Accept ICMP"
|
|
|
|
tcp dport 22 accept comment "Allow ssh connection from home subnet"
|
|
|
|
tcp dport 443 accept comment "Wireguard port"
|
|
tcp dport 80 accept comment "Wireguard port"
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority filter;
|
|
}
|
|
chain output {
|
|
type filter hook output priority filter;
|
|
}
|
|
} |