37 lines
1 KiB
Plaintext
37 lines
1 KiB
Plaintext
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority filter; policy drop
|
|
|
|
ct state vmap { invalid : drop, established : accept, related : accept }
|
|
iif lo accept
|
|
|
|
ip protocol icmp icmp type {
|
|
echo-request, echo-reply, destination-unreachable,
|
|
parameter-problem, time-exceeded,
|
|
} accept comment "accept some ICMPv4"
|
|
|
|
ip6 nexthdr icmpv6 icmpv6 type {
|
|
echo-request, echo-reply, destination-unreachable,
|
|
packet-too-big, parameter-problem, time-exceeded,
|
|
} accept comment "accept some ICMPv6"
|
|
|
|
ip6 hoplimit 255 ip6 nexthdr icmpv6 icmpv6 type {
|
|
nd-neighbor-advert, nd-neighbor-solicit, nd-router-advert, nd-router-solicit
|
|
} accept comment "accept IPv6 neighbor discovery"
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter; policy accept
|
|
}
|
|
}
|
|
|
|
include "/etc/nftables.d/*.nft"
|