router/nftables.conf

115 lines
3.1 KiB
Plaintext
Raw Normal View History

define WAN = wan0
2021-07-10 23:48:10 -05:00
define LAN = lan0
2021-07-11 00:34:29 -05:00
define ROUTER_TCP_PORTS = { 22 }
define ROUTER_UDP_PORTS = { 546, 53, 67 }
define ROUTER_INET_PORTS = { 546, 53, 67 }
2021-07-10 23:48:10 -05:00
define FACELESS_TCP_PORTS = { 443, 80, 2222, 2200 }
2021-07-11 00:34:29 -05:00
# define FACELESS_UDP_PORTS = { }
2021-07-10 23:48:10 -05:00
define DRAGON_TCP_PORTS = { 2221 }
2021-07-11 00:34:29 -05:00
# define DRAGON_UDP_PORTS = { }
2021-07-10 23:48:10 -05:00
2021-07-09 17:21:45 -05:00
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
2021-07-10 23:48:10 -05:00
iifname "lo" accept
2021-07-11 00:34:29 -05:00
icmpv6 type {echo-request,nd-neighbor-solicit,nd-neighbor-advert,nd-router-solicit,nd-router-advert,mld-listener-query} accept
2021-07-09 17:21:45 -05:00
ct state { established, related } accept
ct state invalid drop
ip protocol icmp accept
meta l4proto ipv6-icmp accept
2021-07-11 00:34:29 -05:00
tcp dport $ROUTER_TCP_PORTS accept
udp dport $ROUTER_UDP_PORTS accept
2021-07-10 23:48:10 -05:00
drop
2021-07-09 17:21:45 -05:00
}
chain forward {
type filter hook forward priority filter; policy accept;
accept
}
chain output {
type filter hook output priority filter; policy accept;
2021-07-10 23:48:10 -05:00
accept
2021-07-09 17:21:45 -05:00
}
}
2021-07-10 14:46:26 -05:00
2021-07-10 23:48:10 -05:00
table ip nat {
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname $LAN masquerade
}
chain prerouting {
type nat hook prerouting priority -100; policy accept;
# ip daddr 10.0.0.1 tcp dport { 80, 443 } dnat to 10.0.0.25
2021-07-10 23:48:10 -05:00
iifname $WAN tcp dport $FACELESS_TCP_PORTS dnat to 10.0.0.25
# iifname $WAN udp dport $FACELESS_UDP_PORTS dnat to 10.0.0.25
iifname $WAN udp dport 60000-60009 dnat to 10.0.0.25
2021-07-10 23:48:10 -05:00
iifname $WAN tcp dport $DRAGON_TCP_PORTS dnat to 10.0.0.10
# iifname $WAN udp dport $DRAGON_UDP_PORTS dnat to 10.0.0.10
iifname $WAN udp dport 60020-60029 dnat to 10.0.0.10
2021-07-10 23:48:10 -05:00
}
}
2021-07-10 14:46:26 -05:00
# the following two blocks were generated by restarting systemd-networkd and
# dumping nftables
# nat ipv4 for lan
2021-07-09 17:21:45 -05:00
table ip io.systemd.nat {
set masq_saddr {
type ipv4_addr
flags interval
elements = { 10.0.0.0/24 }
}
map map_port_ipport {
type inet_proto . inet_service : ipv4_addr . inet_service
}
chain prerouting {
type nat hook prerouting priority dstnat + 1; policy accept;
fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
}
chain output {
type nat hook output priority -99; policy accept;
ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
}
chain postrouting {
type nat hook postrouting priority srcnat + 1; policy accept;
ip saddr @masq_saddr masquerade
}
}
2021-07-10 14:46:26 -05:00
# nat ipv6 for lan (probably unnecessary?)
2021-07-11 00:34:29 -05:00
# table ip6 io.systemd.nat {
# set masq_saddr {
# type ipv6_addr
# flags interval
# }
#
# map map_port_ipport {
# type inet_proto . inet_service : ipv6_addr . inet_service
# }
#
# chain prerouting {
# type nat hook prerouting priority dstnat + 1; policy accept;
# fib daddr type local dnat ip6 addr . port to meta l4proto . th dport map @map_port_ipport
# }
#
# chain output {
# type nat hook output priority -99; policy accept;
# ip6 daddr != ::1 oif "lo" dnat ip6 addr . port to meta l4proto . th dport map @map_port_ipport
# }
#
# chain postrouting {
# type nat hook postrouting priority srcnat + 1; policy accept;
# ip6 saddr @masq_saddr masquerade
# }
# }