Эхлэл Бүгдийг харах Тусламж
Бүртгүүлэх Нэвтрэх
tBKwtWS
/
netfilter-config
1
0
Салаа 0
Файлууд
Салаа: vps.h0v1n8
Салаанууд Тагууд
netfilter-confi...
/
nftables.test.rules.save

nftables.test.rules.save 4.9 KB
Байнгын холболт Түүх Анхны өгөгдөл

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107 
  1. #!/usr/sbin/nft -f
    2. 

  2. 

  3. # Well known ports      0:1023
    4. 

  4. # Registered ports      1024:49151
    5. 

  5. # Goldielocks zone      32768:65535
    6. 

  6. # Dynamic/Private       49152:65535
    7. 

  7. #
    8. 

  8. # WAN			86.83.121.29
    9. 

  9. # vps			185.66.250.42
    10. 

  10. # tor-exit		185.87.185.45
    11. 

  11. 

  12. # To preent double enries when loading rules when rule smight already be present.
    13. 

  13. flush ruleset
    14. 

  14. 

  15. 

  16. # IPv6 specific
    17. 

  17. add table ip6 filter
    18. 

  18. add chain ip6 filter INPUT { type filter hook input priority 0; policy accept; }
    19. 

  19. add chain ip6 filter FORWARD { type filter hook forward priority 0; policy accept; }
    20. 

  20. add chain ip6 filter OUTPUT { type filter hook output priority 0; policy accept; }
    21. 

  21. #add chain ip6 filter clutter
    22. 

  22. 

  23. 

  24. 

  25. # IPv4 & IPv6 combined
    26. 

  26. add table inet filter
    27. 

  27. add chain inet filter INPUT { type filter hook input priority 0; policy accept; }
    28. 

  28. add chain inet filter FORWARD { type filter hook forward priority 0; policy accept; }
    29. 

  29. add chain inet filter OUTPUT { type filter hook output priority 0; policy accept; }
    30. 

  30. add chain inet filter clutter
    31. 

  31. 

  32. # Accept neighbour discovery otherwise IPv6 connectivity breaks
    33. 

  33. add rule inet filter INPUT ip6 nexthdr icmpv6 icmpv6 type { nd-redirect, nd-neighbor-solicit,  nd-router-advert, nd-neighbor-advert } accept # nd-redirect might not be required
    34. 

  34. 

  35. #  accept dynamic IPv6 configuration and neighbor discovery
    36. 

  36. add rule ip6 filter INPUT icmpv6 type nd-neighbor-solicit accept
    37. 

  37. add rule ip6 filter INPUT icmpv6 type nd-router-advert accept
    38. 

  38. 

  39. # Local loopback
    40. 

  40. add rule inet filter INPUT iifname != "lo" ip daddr 127.0.0.0/8 limit rate 5/minute burst 5 packets counter log prefix "iptables dropped 127.0.0.0/8," level debug
    41. 

  41. add rule inet filter INPUT iifname != "lo" ip daddr 127.0.0.0/8 counter drop
    42. 

  42. add rule inet filter INPUT iifname "lo" counter accept
    43. 

  43. add rule inet filter OUTPUT oifname "lo" counter accept
    44. 

  44. 

  45. # Active connections
    46. 

  46. add rule inet filter INPUT ct state related,established counter accept
    47. 

  47. add rule inet filter OUTPUT ct state related,established counter accept
    48. 

  48. 

  49. # ICMP ping
    50. 

  50. add rule inet filter OUTPUT icmp type echo-request counter accept
    51. 

  51. 

  52. # SSH
    53. 

  53. add rule inet filter INPUT tcp sport 1024-65535 tcp dport 22 counter accept
    54. 

  54. add rule inet filter OUTPUT tcp sport 32768-65535 tcp dport 22 counter accept
    55. 

  55. 

  56. # WHOIS
    57. 

  57. add rule inet filter OUTPUT tcp sport 32768-65535 tcp dport 43 counter accept
    58. 

  58. 

  59. # DNS
    60. 

  60. add rule inet filter OUTPUT udp sport 1024-65535 udp dport 53 counter accept
    61. 

  61. add rule inet filter OUTPUT tcp sport 32768-65535 tcp dport 53 counter accept
    62. 

  62. add rule inet filter INPUT udp sport 1024-65535 udp dport 53 counter accept
    63. 

  63. add rule inet filter INPUT tcp sport 32768-65535 tcp dport 53 counter accept
    64. 

  64. 

  65. # DHCP client
    66. 

  66. add rule inet filter INPUT ip daddr 255.255.255.255 udp sport 67 udp dport 68 counter accept
    67. 

  67. add rule inet filter OUTPUT udp sport 68 udp dport 67 counter accept
    68. 

  68. 

  69. # HTTP(s)
    70. 

  70. add rule inet filter INPUT tcp dport 80 counter accept
    71. 

  71. add rule inet filter OUTPUT tcp sport 32768-65535 tcp dport 80 counter accept
    72. 

  72. add rule inet filter INPUT tcp dport 443 counter accept
    73. 

  73. add rule inet filter OUTPUT tcp sport 32768-65535 tcp dport 443 counter accept
    74. 

  74. 

  75. # NTP
    76. 

  76. add rule inet filter OUTPUT udp sport 32768-65535 udp dport 123 counter accept
    77. 

  77. 

  78. # Privoxy
    79. 

  79. add rule inet filter INPUT tcp sport 32768-65535 tcp dport 8118 counter accept comment "Privoxy"
    80. 

  80. 

  81. # OpenPGP HTTP Key servers
    82. 

  82. add rule inet filter OUTPUT tcp sport 32768-65535 tcp dport 11371 counter accept comment "OpenPGP HTTP key servers"
    83. 

  83. 

  84. # Traceroute
    85. 

  85. add rule inet filter OUTPUT udp sport 32768-65535 udp dport 6881-33534 counter accept comment "Traceroute"
    86. 

  86. 

  87. # Attacks, crawls, scans, etc to clutter chain
    88. 

  88. add rule inet filter INPUT ip protocol icmp counter jump clutter
    89. 

  89. add rule inet filter INPUT ip daddr 255.255.255.255 counter jump clutter comment "Broadcast messages"
    90. 

  90. add rule inet filter INPUT udp dport 19 counter jump clutter comment "Character generator, looping to echo = DDoS"
    91. 

  91. add rule inet filter INPUT tcp dport 23 counter jump clutter
    92. 

  92. add rule inet filter INPUT udp dport 53 counter jump clutter
    93. 

  93. add rule inet filter INPUT udp dport 111 counter jump clutter comment "Probe/fingerprint Nix OS"
    94. 

  94. add rule inet filter INPUT tcp dport 445 counter jump clutter comment "MS-DS active directory"
    95. 

  95. add rule inet filter INPUT tcp dport 2323 counter jump clutter comment "3d-nfsd"
    96. 

  96. add rule inet filter INPUT udp dport 5060 counter jump clutter
    97. 

  97. add rule inet filter INPUT tcp dport 3389 counter jump clutter comment "MS terminal server RDP"
    98. 

  98. 

  99. # Log & drop
    100. 

  100. add rule inet filter INPUT limit rate 5/minute burst 5 packets counter log prefix "iptables dropped: " level debug
    101. 

  101. add rule inet filter INPUT counter drop
    102. 

  102. add rule inet filter FORWARD limit rate 5/minute burst 5 packets counter log prefix "iptables forward dropped: " level debug
    103. 

  103. add rule inet filter FORWARD counter drop
    104. 

  104. add rule inet filter OUTPUT limit rate 5/minute burst 5 packets counter log prefix "iptables rejected: " level debug
    105. 

  105. add rule inet filter OUTPUT counter reject
    106. 

  106. add rule inet filter clutter limit rate 5/minute burst 5 packets counter log prefix "iptables clutter dropped: " level debug
    107. 

  107. add rule inet filter clutter counter drop
    108.