Nftables Testserver - Versionsgeschichte

Martin Kirner: /* Stand 15.08.2020 */

2020-08-16T10:07:27Z

Stand 15.08.2020

← Nächstältere Version		Version vom 16. August 2020, 10:07 Uhr
Zeile 19:		Zeile 19:
	\|}		\|}

	== Stand 15.08.2020 ==		== Stand 16.08.2020 ==

	<pre>		<pre>
Zeile 58:		Zeile 58:
	# mysql (3306)		# mysql (3306)
	meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";		meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			# dhcp server (67)
			udp dport { bootps } accept;

	counter comment "count dropped packets"		counter comment "count dropped packets"

Martin Kirner: /* Stand 10.04.2020 */

2020-08-15T17:31:25Z

Stand 10.04.2020

← Nächstältere Version		Version vom 15. August 2020, 17:31 Uhr
Zeile 19:		Zeile 19:
	\|}		\|}

	== Stand 10.04.2020 ==		== Stand 15.08.2020 ==

	<pre>		<pre>
Zeile 31:		Zeile 31:
	flags interval		flags interval
	auto-merge		auto-merge
	elements = { 10.2.0.0/24, 10.0.0.0/24, 10.9.2.0/24 }		elements = { 10.2.0.0/24, 10.0.0.0/24, 10.3.0.0/24 }
	}		}

Zeile 44:		Zeile 44:

	# icmp (ping)		# icmp (ping)
	iifname "~~wlan0~~" icmp type echo-request accept;		iifname "eth0" icmp type echo-request accept;
	iifname "~~tun0" icmp type echo-request accept;~~		iifname "wlan0" ip daddr { 10.2.0.175 } icmp type echo-request accept;
	~~iifname "eth0~~" ip daddr { 10.3.0.1 } icmp type echo-request accept;

	# open sshd (22) for internal networks only		# open sshd (22) for internal networks only
Zeile 56:		Zeile 55:
	# open udp ports: domain (53), openvpn (1194)		# open udp ports: domain (53), openvpn (1194)
	udp dport { domain, openvpn } accept;		udp dport { domain, openvpn } accept;

	~~# dhcp ports: bootps (67)~~
	~~udp dport { bootps } accept;~~

	# mysql (3306)		# mysql (3306)
	meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";		meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			counter comment "count dropped packets"
	#log		#log
	}		}
Zeile 68:		Zeile 65:
	chain forward {		chain forward {
	type filter hook forward priority 0; policy drop;		type filter hook forward priority 0; policy drop;

	ip saddr @internal_networks_ip4 accept;		ip saddr @internal_networks_ip4 accept;
	iifname "wlan0" oifname "tun0" ct state related,established accept;		iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
	~~#log~~		iifname "wlan0" oifname "eth0" ct state related,established accept;
	}		}

	chain output {		chain output {
	type filter hook output priority ~~100~~; policy accept;		type filter hook output priority 0; policy accept;
	}		}
	}		}
Zeile 89:		Zeile 86:
	chain postrouting {		chain postrouting {
	type nat hook postrouting priority 100; policy accept;		type nat hook postrouting priority 100; policy accept;
	oifname "wlan0" ip saddr 10.9.2.0/24 masquerade;		oifname "wlan0" ip saddr 10.8.5.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.5.0/24 masquerade;
			oifname "wlan0" ip saddr 10.3.0.0/24 masquerade;
	}		}
	}		}

Martin Kirner: /* Schnittstellen */

2020-08-15T17:30:08Z

Schnittstellen

← Nächstältere Version		Version vom 15. August 2020, 17:30 Uhr
Zeile 8:		Zeile 8:
	\| WAN		\| WAN
	\| eth0		\| eth0
	\| 10.3.0.1		\| 10.2.0.175
	\|-		\|-
	\| LAN		\| LAN
	\| wlan0		\| wlan0
	\| 10.2.0.99		\| 10.3.0.1
	\|-		\|-
	\| OpenVPN		\| OpenVPN
	\| tun0		\| tun0
	\| ~~10.9.2.1~~		\| ---
	\|}		\|}

Martin Kirner: /* Schnittstellen */

2020-04-10T11:35:40Z

Schnittstellen

← Nächstältere Version		Version vom 10. April 2020, 11:35 Uhr
Zeile 6:		Zeile 6:
	! IP-Adresse		! IP-Adresse
	\|-		\|-
	\| WAN:		\| WAN
	\| "eth0"		\| eth0
	\| "10.3.0.1"		\| 10.3.0.1
			\|-
			\| LAN
			\| wlan0
			\| 10.2.0.99
			\|-
			\| OpenVPN
			\| tun0
			\| 10.9.2.1
	\|}		\|}

	~~LAN: "wlan0" / "10.2.0.99"~~

	~~OpenVPN: "tun0" / "10.9.2.1"~~

	== Stand 10.04.2020 ==		== Stand 10.04.2020 ==

Martin Kirner: /* Schnittstellen */

2020-04-10T11:34:14Z

Schnittstellen

← Nächstältere Version		Version vom 10. April 2020, 11:34 Uhr
Zeile 1:		Zeile 1:
	== Schnittstellen ==		== Schnittstellen ==

	WAN: "eth0" / "10.3.0.1"		{\| class="wikitable"
			! Schnittstelle
			! Name
			! IP-Adresse
			\|-
			\| WAN:
			\| "eth0"
			\| "10.3.0.1"
			\|}

	LAN: "wlan0" / "10.2.0.99"		LAN: "wlan0" / "10.2.0.99"

Martin Kirner: /* Schnittstellen */

2020-04-10T11:31:36Z

Schnittstellen

← Nächstältere Version		Version vom 10. April 2020, 11:31 Uhr
Zeile 4:		Zeile 4:

	LAN: "wlan0" / "10.2.0.99"		LAN: "wlan0" / "10.2.0.99"

			OpenVPN: "tun0" / "10.9.2.1"

	== Stand 10.04.2020 ==		== Stand 10.04.2020 ==

Martin Kirner: /* Stand 10.04.2020 */

2020-04-10T11:30:24Z

Stand 10.04.2020

← Nächstältere Version		Version vom 10. April 2020, 11:30 Uhr
Zeile 1:		Zeile 1:
			== Schnittstellen ==

			WAN: "eth0" / "10.3.0.1"

			LAN: "wlan0" / "10.2.0.99"

	== Stand 10.04.2020 ==		== Stand 10.04.2020 ==

Martin Kirner am 10. April 2020 um 11:23 Uhr

2020-04-10T11:23:57Z

← Nächstältere Version		Version vom 10. April 2020, 11:23 Uhr
Zeile 1:		Zeile 1:
			== Stand 10.04.2020 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			table inet filter {
			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.2.0.0/24, 10.0.0.0/24, 10.9.2.0/24 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 10.3.0.1 } icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# dhcp ports: bootps (67)
			udp dport { bootps } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			#log
			}

			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;

			#log
			}

			chain output {
			type filter hook output priority 100; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.9.2.0/24 masquerade;
			}
			}
			</pre>


	Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen\|nftables]]		Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen\|nftables]]

Martin Kirner: Die Seite wurde neu angelegt: „ Zurück zu nftables“

2020-04-10T11:20:46Z

Die Seite wurde neu angelegt: „ Zurück zu nftables“

Neue Seite

Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen|nftables]]