Nftables Mailserver - Versionsgeschichte

Martin Kirner am 28. November 2020 um 16:58 Uhr

2020-11-28T16:58:14Z

← Nächstältere Version		Version vom 28. November 2020, 16:58 Uhr
Zeile 1:		Zeile 1:
			== Stand 28.11.2020 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			include "/etc/nftables/fail2ban.conf"

			table inet filter {
			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.4.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.11 } icmp type echo-request accept;
			iifname "eth1" icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mail ports: pop3 (143), imap (110), submission (SMTP/587), smtp (25), doveadm (47111)
			tcp dport { pop3, imap2, submission, smtp, 47111 } accept;
			udp dport { imap2 } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			counter comment "count dropped packets"
			#log
			}


			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
			iifname "eth1" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "wlan0" ct state related,established accept;
			iifname "eth0" oifname "eth1" ct state related,established accept;
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.4.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.4.0/24 masquerade;
			oifname "eth0" ip saddr 10.0.0.0/24 masquerade;
			oifname "eth1" ip saddr 10.8.4.0/24 masquerade;
			}
			}
			</pre>

	== Stand 17.8.2020 ==		== Stand 17.8.2020 ==

Martin Kirner: /* Stand 17.04.2020 */

2020-08-17T20:54:39Z

Stand 17.04.2020

← Nächstältere Version		Version vom 17. August 2020, 20:54 Uhr
Zeile 1:		Zeile 1:
			== Stand 17.8.2020 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			include "/etc/nftables/fail2ban.conf"

			table inet filter {
			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.4.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.11 } icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mail ports: pop3 (143), imap (110), submission (SMTP/587), smtp (25), doveadm (47111)
			tcp dport { pop3, imap2, submission, smtp, 47111 } accept;
			udp dport { imap2 } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			counter comment "count dropped packets"
			#log
			}

			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "wlan0" ct state related,established accept;
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.4.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.4.0/24 masquerade;
			oifname "eth0" ip saddr 10.0.0.0/24 masquerade;
			}
			}
			</pre>

	== Stand 17.04.2020 ==		== Stand 17.04.2020 ==

Martin Kirner am 17. April 2020 um 17:11 Uhr

2020-04-17T17:11:02Z

← Nächstältere Version		Version vom 17. April 2020, 17:11 Uhr
Zeile 1:		Zeile 1:
	~~{{note\|Noch in Bearbeitung}}~~


	== Stand 17.04.2020 ==		== Stand 17.04.2020 ==

Martin Kirner: /* Stand 10.04.2020 */

2020-04-17T17:10:51Z

Stand 10.04.2020

← Nächstältere Version		Version vom 17. April 2020, 17:10 Uhr
Zeile 2:		Zeile 2:


	== Stand 10.04.2020 ==		== Stand 17.04.2020 ==

	<pre>		<pre>
Zeile 8:		Zeile 8:

	flush ruleset		flush ruleset

			include "/etc/nftables/fail2ban.conf"

	table inet filter {		table inet filter {
Zeile 27:		Zeile 29:

	# icmp (ping)		# icmp (ping)
	icmp type echo-request accept;		iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.11 } icmp type echo-request accept;

	# open sshd (22) for internal networks only		# open sshd (22) for internal networks only
	tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"		tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"
	~~#tcp dport { ssh } accept comment "accept SSH from all networks"~~

	# open tcp ports: http (80), https (443)		# open tcp ports: http (80), https (443)
Zeile 47:		Zeile 50:

	counter comment "count dropped packets"		counter comment "count dropped packets"
			#log
	}		}

Zeile 52:		Zeile 56:
	chain forward {		chain forward {
	type filter hook forward priority 0; policy drop;		type filter hook forward priority 0; policy drop;
	~~counter comment~~ "~~count dropped packets~~"
			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
	}		}

	chain output {		chain output {
	type filter hook output priority 0; policy accept;		type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.4.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.4.0/24 masquerade;
	}		}
	}		}

Martin Kirner: /* Stand 10.04.2020 */

2020-04-10T11:28:59Z

Stand 10.04.2020

← Nächstältere Version		Version vom 10. April 2020, 11:28 Uhr
Zeile 1:		Zeile 1:
			{{note\|Noch in Bearbeitung}}


	== Stand 10.04.2020 ==		== Stand 10.04.2020 ==

Martin Kirner am 10. April 2020 um 11:22 Uhr

2020-04-10T11:22:11Z

← Nächstältere Version		Version vom 10. April 2020, 11:22 Uhr
Zeile 1:		Zeile 1:
			== Stand 10.04.2020 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			table inet filter {
			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.4.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"
			#tcp dport { ssh } accept comment "accept SSH from all networks"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mail ports: pop3 (143), imap (110), submission (SMTP/587), smtp (25), doveadm (47111)
			tcp dport { pop3, imap2, submission, smtp, 47111 } accept;
			udp dport { imap2 } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			counter comment "count dropped packets"
			}


			chain forward {
			type filter hook forward priority 0; policy drop;
			counter comment "count dropped packets"
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}
			</pre>


	Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen\|nftables]]		Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen\|nftables]]

Martin Kirner: Die Seite wurde neu angelegt: „ Zurück zu nftables“

2020-04-10T11:20:55Z

Die Seite wurde neu angelegt: „ Zurück zu nftables“

Neue Seite

Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen|nftables]]