48 lines
1.6 KiB
Plaintext
48 lines
1.6 KiB
Plaintext
|
#!/usr/bin/env nft -f
|
||
|
|
|
||
|
|
table ip filter {
|
||
|
|
chain output {
|
||
|
|
type filter hook output priority 100; policy accept;
|
||
|
|
}
|
||
|
|
|
||
|
|
chain input {
|
||
|
|
type filter hook input priority 0; policy drop;
|
||
|
|
|
||
|
|
iifname lo accept
|
||
|
|
|
||
|
|
# Open the specific ports that we allow
|
||
|
|
{% for port in tcpPorts %}
|
||
|
|
iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } tcp dport {{ port }} accept
|
||
|
|
{% endfor %}
|
||
|
|
{% for port in udpPorts %}
|
||
|
|
iifname { {{ lanInterfaces | join(", ") }}, "tailscale0" } udp dport {{ port }} accept
|
||
|
|
{% endfor %}
|
||
|
|
|
||
|
|
iifname { {{ lanInterfaces | join(", ") }} } accept comment "Allows LAN traffic and outgoing"
|
||
|
|
iifname { {{ wanInterface }} } ct state { established, related } accept comment "Allows existing connections"
|
||
|
|
iifname { {{ wanInterface }} } icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic"
|
||
|
|
iifname { {{ wanInterface }} } counter drop comment "Drop other incoming traffic, and count how much"
|
||
|
|
}
|
||
|
|
chain forward {
|
||
|
|
type filter hook forward priority 0; policy drop;
|
||
|
|
iifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } oifname { {{ wanInterface }} } accept comment "Forward LAN to WAN"
|
||
|
|
iifname { {{ wanInterface }} } oifname { {{ (lanInterfaces + limitedLan) | join(", ") }} } ct state established, related accept comment "Allow incoming established traffic"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
table ip nat {
|
||
|
|
chain postrouting {
|
||
|
|
type nat hook postrouting priority 100; policy accept;
|
||
|
|
oifname { {{ wanInterface }} } masquerade
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
table ip6 filter {
|
||
|
|
chain input {
|
||
|
|
type filter hook input priority 0; policy drop;
|
||
|
|
}
|
||
|
|
chain forward {
|
||
|
|
type filter hook forward priority 0; policy drop;
|
||
|
|
}
|
||
|
|
}
|