1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input_ipv4 {
icmp type echo-request limit rate 5/second accept
}
chain input_ipv6 {
icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
icmpv6 type echo-request limit rate 5/second accept
}
chain input {
type filter hook input priority filter; policy drop;
ct state vmap { established : accept, related : accept, invalid : drop }
iifname lo accept
meta protocol vmap { ip : jump input_ipv4, ip6 : jump input_ipv6 }
tcp dport { 1738 } accept
udp dport { 51820 } accept # WireGuard
log prefix "(nftables) input denied: " counter drop
}
# Priority 1 because iptables-nft uses 0 (filter) by default.
chain forward {
type filter hook forward priority 1; policy accept;
}
}
table ip denpa_nat {
chain prerouting {
type nat hook prerouting priority dstnat;
ip daddr 66.135.26.42 tcp dport { ssh, http, https, 993, 465, 25, 587 } dnat to 192.168.29.2;
}
chain postrouting {
type nat hook postrouting priority srcnat;
ip saddr 192.168.29.2 masquerade
}
}
table ip6 denpa_nat {
chain prerouting {
type nat hook prerouting priority dstnat;
ip6 daddr 2001:19f0:5:58f:5400:4ff:fe7f:fae1 tcp dport { ssh, http, https, 993, 465, 25, 587 } dnat to aa29::2;
}
chain postrouting {
type nat hook postrouting priority srcnat;
ip6 saddr aa29::2 masquerade
}
}
|