diff options
Diffstat (limited to 'straper/db/public/firewall/nft-ruleset.txt')
| -rw-r--r-- | straper/db/public/firewall/nft-ruleset.txt | 264 |
1 files changed, 0 insertions, 264 deletions
diff --git a/straper/db/public/firewall/nft-ruleset.txt b/straper/db/public/firewall/nft-ruleset.txt deleted file mode 100644 index 45ac4ae..0000000 --- a/straper/db/public/firewall/nft-ruleset.txt +++ /dev/null @@ -1,264 +0,0 @@ -table inet nat { - chain postrouting { - type nat hook postrouting priority srcnat; policy accept; - oifname "enx00e04c2e4828" ip saddr 10.50.0.0/24 counter packets 0 bytes 0 masquerade - } -} -table inet filter { - chain input { - type filter hook input priority filter; policy drop; - iif "lo" accept - ct state invalid drop - ct state { established, related } accept - ip saddr 10.50.0.0/24 udp dport 53 accept - ip saddr 10.50.0.0/24 tcp dport 53 accept - ip saddr 192.168.33.0/24 udp dport 53 accept - ip saddr 192.168.33.0/24 tcp dport 53 accept - ip saddr 172.22.0.0/16 udp dport 53 accept - ip saddr 172.22.0.0/16 tcp dport 53 accept - ip protocol icmp accept - ip6 nexthdr ipv6-icmp accept - ip saddr 192.168.33.0/24 tcp dport 2222 ct state new accept - iifname "wg0" tcp dport 2222 ct state new accept - iifname "wg0" tcp dport 8080 ct state new accept - iifname "wg0" tcp dport 3000 ct state new accept - iifname "wg0" tcp dport { 3001, 8002 } ct state new accept - iifname "wg0" tcp dport 3300 ct state new accept - udp dport 52220 accept - udp sport 67 udp dport 68 accept - ip saddr 192.168.33.0/24 tcp dport 57385 ct state new limit rate 15/minute burst 5 packets counter packets 24 bytes 1440 accept - ip saddr 192.168.33.0/24 tcp dport 8000 ct state new counter packets 0 bytes 0 accept - tcp dport 57385 ct state new limit rate 30/minute burst 20 packets counter packets 7285 bytes 439500 accept - tcp dport { 443, 9080 } ct state new accept - ct state new tcp dport 52220 accept - ct state new tcp dport 52690 accept - tcp dport 64738 ct state new accept - udp dport 64738 accept - tcp dport 1965 ct state new accept - tcp dport 70 ct state new accept - counter packets 100331 bytes 24311938 drop - ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 5055, 8502 } ct state new accept - ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 3100, 9090, 9095, 9096, 9100, 9516 } ct state new accept - ip saddr 192.168.33.0/24 tcp dport 3300 ct state new accept - tcp dport 5355 drop - udp dport 5355 drop - ip saddr != { 10.50.0.0/24, 192.168.33.0/24 } tcp dport 8000 drop - } - - chain forward { - type filter hook forward priority filter; policy drop; - ct state { established, related } accept - iifname "wg0" oifname "enx00e04c2e4828" counter packets 0 bytes 0 accept - iifname "wg0" accept - iifname "enx00e04c2e4828" oifname "wg0" accept - iif "enx00e04c2e4828" oifname "br-*" accept - iifname "br-*" oif "enx00e04c2e4828" accept - iifname "br-*" oifname "wg0" accept - } - - chain output { - type filter hook output priority filter; policy accept; - } -} -# Warning: table ip nat is managed by iptables-nft, do not touch! -table ip nat { - chain DOCKER { - ip daddr 10.50.0.1 iifname != "br-07462fa2c80e" tcp dport 8080 counter packets 4430 bytes 265800 dnat to 172.18.0.2:8080 - ip daddr 127.0.0.1 iifname != "br-454eb7778b0a" tcp dport 8081 counter packets 0 bytes 0 dnat to 172.19.0.2:8080 - iifname != "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 dnat to 172.26.0.3:5055 - iifname != "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 dnat to 172.26.0.3:8502 - ip daddr 127.0.0.1 iifname != "br-ed53bc5d2155" tcp dport 9081 counter packets 0 bytes 0 dnat to 172.20.0.2:80 - ip daddr 127.0.0.1 iifname != "br-de49ada7ecfc" tcp dport 9091 counter packets 0 bytes 0 dnat to 172.21.0.4:80 - ip daddr 127.0.0.1 iifname != "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 dnat to 172.25.0.2:9001 - iifname != "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 dnat to 172.23.0.4:8000 - ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3101 counter packets 0 bytes 0 dnat to 172.24.0.2:3000 - ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3103 counter packets 0 bytes 0 dnat to 172.24.0.2:3003 - iifname != "br-8f7fc81a0600" tcp dport 2222 counter packets 9 bytes 540 dnat to 172.30.0.2:22 - iifname != "br-8f7fc81a0600" tcp dport 3300 counter packets 318 bytes 19080 dnat to 172.30.0.2:3000 - ip daddr 10.50.0.1 iifname != "br-e2d8a9eac20e" tcp dport 3001 counter packets 19 bytes 1138 dnat to 172.22.0.2:3001 - } - - chain PREROUTING { - type nat hook prerouting priority dstnat; policy accept; - fib daddr type local counter packets 249517 bytes 32928887 jump DOCKER - } - - chain OUTPUT { - type nat hook output priority dstnat; policy accept; - ip daddr != 127.0.0.0/8 fib daddr type local counter packets 5296 bytes 317760 jump DOCKER - } - - chain POSTROUTING { - type nat hook postrouting priority srcnat; policy accept; - ip saddr 172.23.0.0/16 oifname != "br-0a3c12139db8" counter packets 0 bytes 0 masquerade - ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade - ip saddr 172.21.0.0/16 oifname != "br-de49ada7ecfc" counter packets 6 bytes 360 masquerade - ip saddr 172.26.0.0/16 oifname != "br-3d1818651f84" counter packets 3 bytes 180 masquerade - ip saddr 172.22.0.0/16 oifname != "br-2fd0bcdb4679" counter packets 32880 bytes 2067095 masquerade - ip saddr 172.18.0.0/16 oifname != "br-07462fa2c80e" counter packets 287 bytes 17220 masquerade - ip saddr 172.20.0.0/16 oifname != "br-ed53bc5d2155" counter packets 2 bytes 120 masquerade - ip saddr 172.24.0.0/16 oifname != "br-bebca6296b94" counter packets 3 bytes 180 masquerade - ip saddr 172.25.0.0/16 oifname != "br-7ad976d6055e" counter packets 0 bytes 0 masquerade - ip saddr 172.19.0.0/16 oifname != "br-454eb7778b0a" counter packets 0 bytes 0 masquerade - } -} -table ip filter { - chain DOCKER { - ip daddr 172.22.0.2 iifname != "br-e2d8a9eac20e" oifname "br-e2d8a9eac20e" tcp dport 3001 counter packets 0 bytes 0 accept - ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" oifname "br-8f7fc81a0600" tcp dport 3000 counter packets 0 bytes 0 accept - ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" oifname "br-8f7fc81a0600" tcp dport 22 counter packets 0 bytes 0 accept - ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3003 counter packets 0 bytes 0 accept - ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3000 counter packets 0 bytes 0 accept - ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 accept - ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 accept - ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" tcp dport 80 counter packets 0 bytes 0 accept - ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" tcp dport 80 counter packets 0 bytes 0 accept - ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 accept - ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 accept - ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" tcp dport 8080 counter packets 0 bytes 0 accept - ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" tcp dport 8080 counter packets 0 bytes 0 accept - iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" counter packets 0 bytes 0 drop - iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" counter packets 0 bytes 0 drop - iifname != "br-bebca6296b94" oifname "br-bebca6296b94" counter packets 0 bytes 0 drop - iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" counter packets 0 bytes 0 drop - iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" counter packets 0 bytes 0 drop - iifname != "br-2fd0bcdb4679" oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 drop - iifname != "br-3d1818651f84" oifname "br-3d1818651f84" counter packets 0 bytes 0 drop - iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" counter packets 0 bytes 0 drop - iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop - iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" counter packets 0 bytes 0 drop - } - - chain DOCKER-FORWARD { - counter packets 1321965 bytes 698498753 jump DOCKER-CT - counter packets 1307852 bytes 661726331 jump DOCKER-INTERNAL - counter packets 1307852 bytes 661726331 jump DOCKER-BRIDGE - iifname "br-454eb7778b0a" counter packets 0 bytes 0 accept - iifname "br-7ad976d6055e" counter packets 0 bytes 0 accept - iifname "br-bebca6296b94" counter packets 40 bytes 8333 accept - iifname "br-ed53bc5d2155" counter packets 37 bytes 4045 accept - iifname "br-07462fa2c80e" counter packets 7631 bytes 1205643 accept - iifname "br-2fd0bcdb4679" counter packets 0 bytes 0 accept - iifname "br-3d1818651f84" counter packets 143 bytes 153471 accept - iifname "br-de49ada7ecfc" counter packets 2928 bytes 163686 accept - iifname "docker0" counter packets 0 bytes 0 accept - iifname "br-0a3c12139db8" counter packets 0 bytes 0 accept - } - - chain DOCKER-BRIDGE { - oifname "br-454eb7778b0a" counter packets 0 bytes 0 jump DOCKER - oifname "br-7ad976d6055e" counter packets 0 bytes 0 jump DOCKER - oifname "br-bebca6296b94" counter packets 0 bytes 0 jump DOCKER - oifname "br-ed53bc5d2155" counter packets 0 bytes 0 jump DOCKER - oifname "br-07462fa2c80e" counter packets 0 bytes 0 jump DOCKER - oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 jump DOCKER - oifname "br-3d1818651f84" counter packets 0 bytes 0 jump DOCKER - oifname "br-de49ada7ecfc" counter packets 0 bytes 0 jump DOCKER - oifname "docker0" counter packets 0 bytes 0 jump DOCKER - oifname "br-0a3c12139db8" counter packets 0 bytes 0 jump DOCKER - } - - chain DOCKER-CT { - oifname "br-454eb7778b0a" ct state established,related counter packets 0 bytes 0 accept - oifname "br-7ad976d6055e" ct state established,related counter packets 0 bytes 0 accept - oifname "br-bebca6296b94" ct state established,related counter packets 37 bytes 12496 accept - oifname "br-ed53bc5d2155" ct state established,related counter packets 33 bytes 25191 accept - oifname "br-07462fa2c80e" ct state established,related counter packets 9081 bytes 12474633 accept - oifname "br-2fd0bcdb4679" ct state established,related counter packets 0 bytes 0 accept - oifname "br-3d1818651f84" ct state established,related counter packets 257 bytes 2107982 accept - oifname "br-de49ada7ecfc" ct state established,related counter packets 4705 bytes 22152120 accept - oifname "docker0" ct state established,related counter packets 0 bytes 0 accept - oifname "br-0a3c12139db8" ct state established,related counter packets 0 bytes 0 accept - } - - chain DOCKER-INTERNAL { - } - - chain FORWARD { - type filter hook forward priority filter; policy accept; - counter packets 1321965 bytes 698498753 jump DOCKER-USER - counter packets 1321965 bytes 698498753 jump DOCKER-FORWARD - } - - chain DOCKER-USER { - } -} -table ip6 nat { - chain DOCKER { - } - - chain PREROUTING { - type nat hook prerouting priority dstnat; policy accept; - fib daddr type local counter packets 0 bytes 0 jump DOCKER - } - - chain OUTPUT { - type nat hook output priority dstnat; policy accept; - ip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER - } -} -table ip6 filter { - chain DOCKER { - } - - chain DOCKER-FORWARD { - counter packets 0 bytes 0 jump DOCKER-CT - counter packets 0 bytes 0 jump DOCKER-INTERNAL - counter packets 0 bytes 0 jump DOCKER-BRIDGE - } - - chain DOCKER-BRIDGE { - } - - chain DOCKER-CT { - } - - chain DOCKER-INTERNAL { - } - - chain FORWARD { - type filter hook forward priority filter; policy accept; - counter packets 0 bytes 0 jump DOCKER-USER - counter packets 0 bytes 0 jump DOCKER-FORWARD - } - - chain DOCKER-USER { - } -} -table ip raw { - chain PREROUTING { - type filter hook prerouting priority raw; policy accept; - ip daddr 172.21.0.2 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop - ip daddr 172.26.0.2 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop - ip daddr 172.21.0.3 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop - ip daddr 172.26.0.3 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop - ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" counter packets 0 bytes 0 drop - ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" counter packets 0 bytes 0 drop - ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" counter packets 0 bytes 0 drop - ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop - ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" counter packets 0 bytes 0 drop - ip daddr 127.0.0.1 iifname != "lo" tcp dport 8081 counter packets 0 bytes 0 drop - ip daddr 127.0.0.1 iifname != "lo" tcp dport 9081 counter packets 0 bytes 0 drop - ip daddr 127.0.0.1 iifname != "lo" tcp dport 9091 counter packets 0 bytes 0 drop - ip daddr 127.0.0.1 iifname != "lo" tcp dport 9001 counter packets 0 bytes 0 drop - ip daddr 172.23.0.2 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop - ip daddr 172.23.0.3 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop - ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop - ip daddr 172.24.0.2 iifname != "br-bebca6296b94" counter packets 0 bytes 0 drop - ip daddr 127.0.0.1 iifname != "lo" tcp dport 3101 counter packets 0 bytes 0 drop - ip daddr 127.0.0.1 iifname != "lo" tcp dport 3103 counter packets 0 bytes 0 drop - ip daddr 127.0.0.1 iifname != "lo" tcp dport 8000 ip saddr != 192.168.33.0/24 counter packets 0 bytes 0 drop - ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" counter packets 0 bytes 0 drop - } -} -table inet f2b-table { - set addr-set-sshd { - type ipv4_addr - flags interval - } - - chain f2b-chain { - type filter hook input priority filter - 1; policy accept; - meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable - } -} |