hosts/station/nftables.conf


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

#!/usr/sbin/nft -f

flush ruleset

table inet filter {
  chain input_ipv4 {
    icmp type echo-request limit rate 5/second accept
  }

  chain input_ipv6 {
    icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
    icmpv6 type echo-request limit rate 5/second accept
  }

  chain input {
    type filter hook input priority filter; policy drop;
    ct state vmap { established : accept, related : accept, invalid : drop }
    iifname lo accept
    meta protocol vmap { ip : jump input_ipv4, ip6 : jump input_ipv6 }
    tcp dport { ssh, http, https, 993, 465, 25, 587 } accept
    log prefix "(nftables) input denied: " counter drop
  }
}