Nftables Router Hofstetten - Versionsgeschichte

Martin Kirner: /* Stand 21.05.2022 */

2022-05-21T09:27:33Z

Stand 21.05.2022

← Nächstältere Version		Version vom 21. Mai 2022, 09:27 Uhr
Zeile 35:		Zeile 35:
	}		}

	# allow packets from LAN to WAN, and WAN to LAN ~~if LAN initiated the connection~~		# allow packets from LAN to WAN and WAN to LAN
	chain forward {		chain forward {
	type filter hook forward priority 0; policy accept;		type filter hook forward priority 0; policy accept;

2022-05-21T09:25:55Z

Stand 07.06.2020

← Nächstältere Version		Version vom 21. Mai 2022, 09:25 Uhr
Zeile 1:		Zeile 1:
			== Stand 21.05.2022 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			# firewall
			table ip filter {
			# allow all packets sent by the firewall machine itself
			chain output {
			type filter hook output priority 100; policy accept;
			}

			# allow LAN to firewall, disallow WAN to firewall
			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			iifname "eth0" accept;

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194), openvpn (1195)
			udp dport { domain, openvpn, 1195 } accept;

			# open sshd (22)
			tcp dport { ssh } accept;
			}

			# allow packets from LAN to WAN, and WAN to LAN if LAN initiated the connection
			chain forward {
			type filter hook forward priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;

			# redirect port 81 to port 80 at 10.1.0.150
			iifname "wlan0" tcp dport 81 dnat 10.1.0.150:80;
			iifname "tun0" tcp dport 81 dnat 10.1.0.150:80;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" masquerade
			}
			}
			</pre>

	== Stand 07.06.2020 ==		== Stand 07.06.2020 ==

2020-06-07T15:27:23Z

Stand 10.04.2020

2020-04-10T11:17:31Z

← Nächstältere Version		Version vom 10. April 2020, 11:17 Uhr
Zeile 1:		Zeile 1:
			== Stand 10.04.2020 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			# firewall
			table ip filter {
			# allow all packets sent by the firewall machine itself
			chain output {
			type filter hook output priority 100; policy accept;
			}

			# allow LAN to firewall, disallow WAN to firewall
			chain input {
			type filter hook input priority 0; policy accept;
			iifname "eth0" accept
			# iifname "wlan0" drop
			iifname "wlan0" accept
			}

			# allow packets from LAN to WAN, and WAN to LAN if LAN initiated the connection
			chain forward {
			# type filter hook forward priority 0; policy drop;
			type filter hook forward priority 0; policy accept;
			# iifname "eth0" oifname "wlan0" accept
			# iifname "wlan0" oifname "eth0" ct state related,established accept
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;

			# redirect port 81 to port 80 at 10.1.0.150
			iif wlan0 tcp dport 81 dnat 10.1.0.150:80;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" masquerade
			}
			}
			</pre>


	Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen\|nftables]]		Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen\|nftables]]

2020-04-10T11:16:24Z

← Nächstältere Version		Version vom 10. April 2020, 11:16 Uhr
Zeile 2:		Zeile 2:


	Zurück ~~zu [[Nftables_(Linux)#BeiZurück~~ zu [[Nftables_(Linux)#Beispielkonfigurationen~~\|nftables]]spiele~~\|nftables]]		Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen\|nftables]]

2020-04-10T11:15:54Z

← Nächstältere Version		Version vom 10. April 2020, 11:15 Uhr
Zeile 2:		Zeile 2:


	Zurück zu [[Nftables_(Linux)#~~Beispiele~~\|nftables]]		Zurück zu [[Nftables_(Linux)#BeiZurück zu [[Nftables_(Linux)#Beispielkonfigurationen\|nftables]]spiele\|nftables]]

2020-04-10T11:13:24Z

Die Seite wurde neu angelegt: „ Zurück zu nftables“

Neue Seite

Zurück zu [[Nftables_(Linux)#Beispiele|nftables]]