Nftables Nameserver - Versionsgeschichte

Martin Kirner: /* Stand 25.06.2022 */

2022-06-25T16:52:43Z

Stand 25.06.2022

← Nächstältere Version		Version vom 25. Juni 2022, 16:52 Uhr
Zeile 2:		Zeile 2:

	<pre>		<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			table inet filter {
			set server_addresses_ip4 {
			type ipv4_addr
			flags constant
			elements = { 212.186.198.10, 212.186.198.11, 212.186.198.12, 212.186.198.14 }
			}

			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.5.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.13 } icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 log prefix "New SSH internal connection: " accept comment "accept SSH from internal networks"
			# open sshd (22) for all my other servers
			tcp dport { ssh } ip saddr @server_addresses_ip4 log prefix "New SSH server connection: " accept comment "accept SSH from my other servers"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			# iperf (5201)
			tcp dport { 5201 } accept;

			# oscam
			tcp dport { 40000 } log prefix "New OSCam connection: " accept;

			#counter log prefix "nft.dropinput: " comment "count dropped packets";
			counter comment "count dropped packets";
			}

			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" ct state related,established accept;
			tcp dport { 40000 } accept;
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;

			tcp dport 40000 dnat 10.0.0.171:40000;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.0.0.0/24 masquerade;
			}
			}
	</pre>		</pre>

Martin Kirner: /* Stand 25.06.2022 */

2022-06-25T16:50:48Z

Stand 25.06.2022

← Nächstältere Version		Version vom 25. Juni 2022, 16:50 Uhr
Zeile 2:		Zeile 2:

	<pre>		<pre>
	~~#!/usr/sbin/nft -f~~

	~~flush ruleset~~

	~~table inet filter {~~
	~~set server_addresses_ip4 {~~
	~~type ipv4_addr~~
	~~flags constant~~
	~~elements = { 212.186.198.10, 212.186.198.11, 212.186.198.12, 212.186.198.14 }~~
	}

	~~set internal_networks_ip4 {~~
	~~type ipv4_addr~~
	~~flags interval~~
	~~auto-merge~~
	~~elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.5.0/24 }~~
	}

	~~chain input {~~
	~~type filter hook input priority 0; policy drop;~~

	~~# established/related connections~~
	~~ct state established,related accept;~~

	~~# loopback interface~~
	~~iifname lo accept;~~

	~~# icmp (ping)~~
	~~iifname "wlan0" icmp type echo-request accept;~~
	~~iifname "tun0" icmp type echo-request accept;~~
	~~iifname "eth0" ip daddr { 212.186.198.13 } icmp type echo-request accept;~~

	~~# open sshd (22) for internal networks only~~
	~~tcp dport { ssh } ip saddr @internal_networks_ip4 log prefix "New SSH internal connection: " accept comment "accept SSH from internal networks"~~
	~~# open sshd (22) for all my other servers~~
	~~tcp dport { ssh } ip saddr @server_addresses_ip4 log prefix "New SSH server connection: " accept comment "accept SSH from my other servers"~~

	~~# open tcp ports: http (80), https (443)~~
	~~tcp dport { http, https } accept;~~

	~~# open udp ports: domain (53), openvpn (1194)~~
	~~udp dport { domain, openvpn } accept;~~

	~~# mysql (3306)~~
	~~meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";~~

	~~# iperf (5201)~~
	~~tcp dport { 5201 } accept;~~

	~~# oscam~~
	~~tcp dport { 40000 } log prefix "New OSCam connection: " accept;~~

	~~#counter log prefix "nft.dropinput: " comment "count dropped packets";~~
	~~counter comment "count dropped packets";~~
	}

	~~chain forward {~~
	~~type filter hook forward priority 0; policy drop;~~

	~~ip saddr @internal_networks_ip4 accept;~~
	~~iifname "wlan0" oifname "tun0" ct state related,established accept;~~
	~~iifname "eth0" oifname "tun0" ct state related,established accept;~~
	~~iifname "eth0" oifname "wlan0" ct state related,established accept;~~
	~~iifname "eth0" oifname "eth0" ct state related,established accept;~~
	}

	~~chain output {~~
	~~type filter hook output priority 0; policy accept;~~
	}
	}

	~~# NAT~~
	~~table ip nat {~~
	~~chain prerouting {~~
	~~type nat hook prerouting priority 0; policy accept;~~

	~~#iifname "eth0" tcp dport 40000 dnat 10.0.0.171:40000;~~
	~~tcp dport 40000 dnat 10.0.0.171:40000;~~
	}

	~~# for all packets to WAN, after routing, replace source address with primary IP of WAN interface~~
	~~chain postrouting {~~
	~~type nat hook postrouting priority 100; policy accept;~~
	~~oifname "wlan0" ip saddr 10.8.5.0/24 masquerade;~~
	~~oifname "eth0" ip saddr 10.8.5.0/24 masquerade;~~
	~~oifname "eth0" ip saddr 10.0.0.0/24 masquerade;~~
	}
	}
	</pre>		</pre>

Martin Kirner am 25. Juni 2022 um 15:09 Uhr

2022-06-25T15:09:57Z

← Nächstältere Version		Version vom 25. Juni 2022, 15:09 Uhr
Zeile 1:		Zeile 1:
			== Stand 25.06.2022 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			table inet filter {
			set server_addresses_ip4 {
			type ipv4_addr
			flags constant
			elements = { 212.186.198.10, 212.186.198.11, 212.186.198.12, 212.186.198.14 }
			}

			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.5.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.13 } icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 log prefix "New SSH internal connection: " accept comment "accept SSH from internal networks"
			# open sshd (22) for all my other servers
			tcp dport { ssh } ip saddr @server_addresses_ip4 log prefix "New SSH server connection: " accept comment "accept SSH from my other servers"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			# iperf (5201)
			tcp dport { 5201 } accept;

			# oscam
			tcp dport { 40000 } log prefix "New OSCam connection: " accept;

			#counter log prefix "nft.dropinput: " comment "count dropped packets";
			counter comment "count dropped packets";
			}

			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "wlan0" ct state related,established accept;
			iifname "eth0" oifname "eth0" ct state related,established accept;
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;

			#iifname "eth0" tcp dport 40000 dnat 10.0.0.171:40000;
			tcp dport 40000 dnat 10.0.0.171:40000;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.0.0.0/24 masquerade;
			}
			}
			</pre>

	== Stand 19.06.2022 ==		== Stand 19.06.2022 ==

Martin Kirner: /* Stand 22.09.2021 */

2022-06-19T14:31:13Z

Stand 22.09.2021

← Nächstältere Version		Version vom 19. Juni 2022, 14:31 Uhr
Zeile 1:		Zeile 1:
			== Stand 19.06.2022 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			table inet filter {
			set server_addresses_ip4 {
			type ipv4_addr
			flags constant
			elements = { 212.186.198.10, 212.186.198.11, 212.186.198.12, 212.186.198.14 }
			}

			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.5.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.13 } icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"
			# open sshd (22) for all my other servers
			tcp dport { ssh } ip saddr @server_addresses_ip4 accept comment "accept SSH from my other servers"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			# iperf (5201)
			tcp dport { 5201 } accept;

			counter comment "count dropped packets"
			#log
			}

			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "wlan0" ct state related,established accept;
			iifname "eth0" tcp dport 40000 dnat 10.0.0.171:40000;
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.0.0.0/24 masquerade;
			}
			}
			</pre>

	== Stand 22.09.2021 ==		== Stand 22.09.2021 ==

Martin Kirner am 22. September 2021 um 22:06 Uhr

2021-09-22T22:06:25Z

← Nächstältere Version		Version vom 22. September 2021, 22:06 Uhr
Zeile 1:		Zeile 1:
			== Stand 22.09.2021 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			table inet filter {
			set server_addresses_ip4 {
			type ipv4_addr
			flags constant
			elements = { 212.186.198.10, 212.186.198.11, 212.186.198.12, 212.186.198.14 }
			}

			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.5.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.13 } icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"
			# open sshd (22) for all my other servers
			tcp dport { ssh } ip saddr @server_addresses_ip4 accept comment "accept SSH from my other servers"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			# iperf (5201)
			tcp dport { 5201 } accept;

			counter comment "count dropped packets"
			#log
			}

			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "wlan0" ct state related,established accept;
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.0.0.0/24 masquerade;
			}
			}
			</pre>

	== Stand 17.08.2020 ==		== Stand 17.08.2020 ==

Martin Kirner: /* Stand 17.08.2020 */

2020-08-17T20:40:05Z

Stand 17.08.2020

← Nächstältere Version		Version vom 17. August 2020, 20:40 Uhr
Zeile 64:		Zeile 64:
	}		}

	# for all packets to WAN, after routing, replace source address with primary I P of WAN interface		# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
	chain postrouting {		chain postrouting {
	type nat hook postrouting priority 100; policy accept;		type nat hook postrouting priority 100; policy accept;

Martin Kirner am 17. August 2020 um 20:39 Uhr

2020-08-17T20:39:22Z

← Nächstältere Version		Version vom 17. August 2020, 20:39 Uhr
Zeile 1:		Zeile 1:
			== Stand 17.08.2020 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			table inet filter {
			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.5.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.13 } icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			counter comment "count dropped packets"
			#log
			}

			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "wlan0" ct state related,established accept;
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;
			}

			# for all packets to WAN, after routing, replace source address with primary I P of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.0.0.0/24 masquerade;
			}
			}
			</pre>

	== Stand 17.04.2020 ==		== Stand 17.04.2020 ==

Martin Kirner am 17. April 2020 um 17:13 Uhr

2020-04-17T17:13:33Z

← Nächstältere Version		Version vom 17. April 2020, 17:13 Uhr
Zeile 1:		Zeile 1:
	~~{{note\|Noch in Bearbeitung}}~~


	== Stand 17.04.2020 ==		== Stand 17.04.2020 ==

Martin Kirner: /* Stand 10.04.2020 */

2020-04-17T17:13:23Z

Stand 10.04.2020

← Nächstältere Version		Version vom 17. April 2020, 17:13 Uhr
Zeile 2:		Zeile 2:


	== Stand 10.04.2020 ==		== Stand 17.04.2020 ==

	<pre>		<pre>
Zeile 27:		Zeile 27:

	# icmp (ping)		# icmp (ping)
	icmp type echo-request accept;		iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.13 } icmp type echo-request accept;

	# open sshd (22) for internal networks only		# open sshd (22) for internal networks only
Zeile 41:		Zeile 43:
	meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";		meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

	~~#iifname~~ "~~wlan0~~" ~~accept;~~		counter comment "count dropped packets"

	#log		#log
	}		}
Zeile 48:		Zeile 49:
	chain forward {		chain forward {
	type filter hook forward priority 0; policy drop;		type filter hook forward priority 0; policy drop;
	~~#type filter hook forward priority 0; policy~~ accept;
			ip saddr @internal_networks_ip4 accept;
	iifname "wlan0" oifname "~~eth0~~" accept;		iifname "wlan0" oifname "tun0" ct state related,established accept;
	iifname "eth0" oifname "~~wlan0~~" ct state related,established accept;		iifname "eth0" oifname "tun0" ct state related,established accept;
	}		}

Zeile 68:		Zeile 69:
	chain postrouting {		chain postrouting {
	type nat hook postrouting priority 100; policy accept;		type nat hook postrouting priority 100; policy accept;
	#ip saddr 10.8.5.0/24 ~~oifname "eth0"~~ masquerade		oifname "wlan0" ip saddr 10.8.5.0/24 masquerade;
	oifname "eth0" masquerade;		oifname "eth0" ip saddr 10.8.5.0/24 masquerade;
	}		}
	}		}

Martin Kirner: Die Seite wurde neu angelegt: „{{note|Noch in Bearbeitung}} == Stand 10.04.2020 ==

 #!/usr/sbin/nft -f  flush ruleset  table inet filter {   set internal_networks_ip4 {     type ipv4…“

2020-04-10T11:28:17Z

Die Seite wurde neu angelegt: „{{note|Noch in Bearbeitung}} == Stand 10.04.2020 == <pre> #!/usr/sbin/nft -f flush ruleset table inet filter { set internal_networks_ip4 { type ipv4…“

Neue Seite

{{note|Noch in Bearbeitung}}

== Stand 10.04.2020 ==

<pre>
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
set internal_networks_ip4 {
type ipv4_addr
flags interval
auto-merge
elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.5.0/24 }
}

chain input {
type filter hook input priority 0; policy drop;

# established/related connections
ct state established,related accept;

# loopback interface
iifname lo accept;

# icmp (ping)
icmp type echo-request accept;

# open sshd (22) for internal networks only
tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"

# open tcp ports: http (80), https (443)
tcp dport { http, https } accept;

# open udp ports: domain (53), openvpn (1194)
udp dport { domain, openvpn } accept;

# mysql (3306)
meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

#iifname "wlan0" accept;

#log
}

chain forward {
type filter hook forward priority 0; policy drop;
#type filter hook forward priority 0; policy accept;

iifname "wlan0" oifname "eth0" accept;
iifname "eth0" oifname "wlan0" ct state related,established accept;
}

chain output {
type filter hook output priority 0; policy accept;
}
}

# NAT
table ip nat {
chain prerouting {
type nat hook prerouting priority 0; policy accept;
}

# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
chain postrouting {
type nat hook postrouting priority 100; policy accept;
#ip saddr 10.8.5.0/24 oifname "eth0" masquerade
oifname "eth0" masquerade;
}
}
</pre>

Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen|nftables]]