router/nftables.conf

94 lines
2.5 KiB
Plaintext
Raw Normal View History

define WAN = wan0
2021-07-10 23:48:10 -05:00
define LAN = lan0
2022-02-07 16:51:23 -06:00
define VPN = wg-vpn
2021-07-10 23:48:10 -05:00
2021-07-09 17:21:45 -05:00
table inet filter {
chain input {
type filter hook input priority filter; policy accept;
2021-07-10 23:48:10 -05:00
iifname "lo" accept
2021-07-09 17:21:45 -05:00
ct state invalid drop
2022-01-31 16:44:36 -06:00
ct state { established, related } accept
2022-02-07 16:51:23 -06:00
icmpv6 type {echo-request,nd-neighbor-solicit,nd-neighbor-advert,nd-router-solicit,nd-router-advert,mld-listener-query,destination-unreachable,packet-too-big,time-exceeded,parameter-problem} accept
2022-01-31 16:44:36 -06:00
ip protocol icmpv6 accept
2021-07-09 17:21:45 -05:00
ip protocol icmp accept
meta l4proto ipv6-icmp accept
2022-02-07 16:51:23 -06:00
# do these need ipv6-specific entries, too?
2022-07-03 20:18:56 -05:00
tcp dport { 51821, 22, 53, 67, 2201, 2221, 25565, 34197 } accept
2022-03-23 13:30:12 -05:00
udp dport { 51821, 51820, 53, 67, 34197 } accept
udp dport { 60000-60009 } accept
udp dport dhcpv6-client accept
2021-07-10 23:48:10 -05:00
drop
2021-07-09 17:21:45 -05:00
}
chain forward {
type filter hook forward priority filter; policy accept;
accept
}
chain output {
type filter hook output priority filter; policy accept;
2022-01-31 16:44:36 -06:00
accept
2021-07-09 17:21:45 -05:00
}
}
2021-07-10 14:46:26 -05:00
2021-07-10 23:48:10 -05:00
table ip nat {
2022-03-23 13:30:12 -05:00
set masq_saddr {
type ipv4_addr
flags interval
2022-07-03 20:18:56 -05:00
elements = { 10.0.0.0/8 }
2022-01-31 16:44:36 -06:00
}
2021-07-10 23:48:10 -05:00
2022-03-23 13:30:12 -05:00
map map_port_ipport {
type inet_proto . inet_service : ipv4_addr . inet_service
}
2021-07-10 23:48:10 -05:00
2022-03-23 13:30:12 -05:00
chain prerouting {
2022-02-09 11:00:24 -06:00
iifname $LAN accept
2022-03-23 13:30:12 -05:00
type nat hook prerouting priority dstnat + 1; policy accept;
fib daddr type local dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
2022-01-31 16:44:36 -06:00
2022-01-31 17:06:53 -06:00
# faceless
2022-03-02 11:32:50 -06:00
iifname $WAN tcp dport { 443, 80, 22 } dnat to 10.0.0.210
2022-02-04 10:45:06 -06:00
iifname $WAN udp dport 60010-60019 dnat to 10.0.0.210
2022-01-31 16:44:36 -06:00
2022-03-23 13:30:12 -05:00
# dragon
2022-07-03 20:18:56 -05:00
# iifname $WAN tcp dport { 2221, 5588, 5589 } dnat to 10.0.0.10
# iifname $WAN udp dport 60020-60029 dnat to 10.0.0.10
# dragon reinstall?
2022-03-02 11:32:50 -06:00
iifname $WAN tcp dport { 2221, 5588, 5589 } dnat to 10.0.0.10
2022-01-31 16:44:36 -06:00
iifname $WAN udp dport 60020-60029 dnat to 10.0.0.10
2022-07-03 20:18:56 -05:00
iifname $WAN udp dport 9876-9877 dnat to 10.0.0.10
2022-01-31 16:44:36 -06:00
2022-01-31 17:06:53 -06:00
# ourcraft
2022-03-02 11:32:50 -06:00
iifname $WAN tcp dport { 25565, 34197 } dnat to 10.0.0.244
iifname $WAN udp dport { 25565, 34197 } dnat to 10.0.0.244
2022-01-31 16:44:36 -06:00
}
2021-07-09 17:21:45 -05:00
chain output {
type nat hook output priority -99; policy accept;
ip daddr != 127.0.0.0/8 oif "lo" dnat ip addr . port to meta l4proto . th dport map @map_port_ipport
}
chain postrouting {
type nat hook postrouting priority srcnat + 1; policy accept;
2022-03-23 13:30:12 -05:00
oifname $LAN masquerade
2021-07-09 17:21:45 -05:00
ip saddr @masq_saddr masquerade
}
}
2021-07-10 14:46:26 -05:00
2022-03-23 13:30:12 -05:00
# table ip filter {
# chain output {
# type filter hook output priority 100; policy accept;
# }
#
# chain input {
# type filter hook input priority 0; policy accept;
# }
#
# chain forward {
# type filter hook forward priority 0; policy accept;
# }
# }
#