diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2020-05-16 02:52:55 +0200 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2020-05-16 05:45:59 +0200 |
| commit | bac7811d2b35252b7a83a45d75bb344b4b1776a9 (patch) | |
| tree | 02176a15d570cab6dbd55b52b6df5c7b7b0538b1 /roles/common/templates/etc/nftables.conf.j2 | |
| parent | c4f24043baeccc95556fb9c3c032505ecadb5fbd (diff) | |
Upgrade baseline to Debian 10.
Diffstat (limited to 'roles/common/templates/etc/nftables.conf.j2')
| -rwxr-xr-x | roles/common/templates/etc/nftables.conf.j2 | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/roles/common/templates/etc/nftables.conf.j2 b/roles/common/templates/etc/nftables.conf.j2 index 1e1fde2..3d2a23d 100755 --- a/roles/common/templates/etc/nftables.conf.j2 +++ b/roles/common/templates/etc/nftables.conf.j2 @@ -69,76 +69,82 @@ table inet filter { icmpv6 type { echo-reply, echo-request, destination-unreachable, packet-too-big, time-exceeded, parameter-problem } counter accept # accept neighbour discovery for autoconfiguration, RFC 4890 sec. 4.4.1 icmpv6 type { 133,134,135,136,141,142 } ip6 hoplimit 255 counter accept jump martian jump invalid udp sport 123 udp dport 123 ct state related,established accept {% if groups.all | length > 1 %} udp sport 500 udp dport 500 ct state new,related,established accept {% if groups.NATed | length > 0 %} udp sport 4500 udp dport 4500 ct state new,related,established accept {% endif %} {% endif %} udp sport 53 ct state related,established accept tcp sport 53 ct state related,established accept {% if 'dhclient' in group_names %} - udp sport 67 ct state related,established accept + ip version 4 udp sport 67 udp dport 68 ct state related,established accept + ip6 version 6 udp sport 547 udp dport 546 ct state related,established accept {% endif %} meta l4proto tcp ip saddr @fail2ban counter drop meta l4proto tcp ip6 saddr @fail2ban6 counter drop tcp dport $in-tcp-ports ct state related,established accept tcp dport $in-tcp-ports ct state new counter accept tcp sport $out-tcp-ports ct state related,established accept } chain output { type filter hook output priority 0 policy drop oif lo accept # XXX Bullseye: unlike for input we can't use marks here, # because by the time we see a packet to 172.16.0.0/24 we don't # know if it'll be encapsulated meta l4proto esp accept ip saddr 172.16.0.7 ip daddr 172.16.0.0/24 accept meta l4proto { icmp, icmpv6 } accept jump martian jump invalid udp sport 123 udp dport 123 ct state new,related,established accept +{% if groups.all | length > 1 %} udp sport 500 udp dport 500 ct state new,related,established accept +{% if groups.NATed | length > 0 %} udp sport 4500 udp dport 4500 ct state new,related,established accept +{% endif %} +{% endif %} udp dport 53 ct state new,related,established accept tcp dport 53 ct state new,related,established accept {% if 'dhclient' in group_names %} - udp dport 67 ct state new,related,established accept + ip version 4 udp sport 68 udp dport 67 ct state new,related,established accept + ip6 version 6 udp sport 546 udp dport 547 ct state new,related,established accept {% endif %} tcp sport $in-tcp-ports ct state related,established accept tcp dport $out-tcp-ports ct state related,established accept tcp dport $out-tcp-ports ct state new counter accept meta l4proto tcp counter reject with tcp reset meta l4proto udp counter reject counter reject } chain martian { # bogon filter (cf. RFC 6890 for non-global ip addresses) define invalid-ip = { 0.0.0.0/8 # this host, on this network (RFC 1122 sec. 3.2.1.3) {% if not ansible_default_ipv4.address | ipaddr('10.0.0.0/8') %} , 10.0.0.0/8 # private-use (RFC 1918) {% endif %} , 100.64.0.0/10 # shared address space (RFC 6598) , 127.0.0.0/8 # loopback (RFC 1122, sec. 3.2.1.3) |