From 39711cf6c2ec5a3b4480dcb4800cc3802bda5bf2 Mon Sep 17 00:00:00 2001 From: Lukasz Kasprzak Date: Fri, 20 Mar 2026 19:16:32 +0100 Subject: feat: first fully successful run e2e on straper --- straper/db/public/firewall/nftables.conf | 258 +++++++++++++++++++++++++++++++ 1 file changed, 258 insertions(+) create mode 100755 straper/db/public/firewall/nftables.conf (limited to 'straper/db/public/firewall/nftables.conf') diff --git a/straper/db/public/firewall/nftables.conf b/straper/db/public/firewall/nftables.conf new file mode 100755 index 0000000..2660509 --- /dev/null +++ b/straper/db/public/firewall/nftables.conf @@ -0,0 +1,258 @@ +flush ruleset + +table inet nat { + chain postrouting { + type nat hook postrouting priority srcnat; policy accept; + oifname "enx00e04c2e4828" ip saddr 10.50.0.0/24 counter packets 0 bytes 0 masquerade + } +} +table inet filter { + chain input { + type filter hook input priority filter; policy drop; + iif "lo" accept + ct state invalid drop + ct state { established, related } accept + ip saddr 10.50.0.0/24 udp dport 53 accept + ip saddr 10.50.0.0/24 tcp dport 53 accept + ip saddr 192.168.33.0/24 udp dport 53 accept + ip saddr 192.168.33.0/24 tcp dport 53 accept + ip saddr 172.22.0.0/16 udp dport 53 accept + ip saddr 172.22.0.0/16 tcp dport 53 accept + ip protocol icmp accept + ip6 nexthdr ipv6-icmp accept + ip saddr 192.168.33.0/24 tcp dport 2222 ct state new accept + iifname "wg0" tcp dport 2222 ct state new accept + iifname "wg0" tcp dport 8080 ct state new accept + iifname "wg0" tcp dport 3000 ct state new accept + iifname "wg0" tcp dport { 3001, 8002 } ct state new accept + iifname "wg0" tcp dport 3300 ct state new accept + udp dport 52220 accept + udp sport 67 udp dport 68 accept + ip saddr 192.168.33.0/24 tcp dport 57385 ct state new limit rate 15/minute burst 5 packets counter packets 5 bytes 300 accept + ip saddr 192.168.33.0/24 tcp dport 8000 ct state new counter packets 0 bytes 0 accept + tcp dport 57385 ct state new limit rate 30/minute burst 20 packets counter packets 472 bytes 28056 accept + tcp dport { 443, 9080 } ct state new accept + ct state new tcp dport 52220 accept + ct state new tcp dport 52690 accept + tcp dport 64738 ct state new accept + udp dport 64738 accept + tcp dport 1965 ct state new accept + tcp dport 70 ct state new accept + counter packets 5683 bytes 896562 drop + ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 5055, 8502 } ct state new accept + ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 3100, 9090, 9095, 9096, 9100, 9516 } ct state new accept + ip saddr 192.168.33.0/24 tcp dport 3300 ct state new accept + tcp dport 5355 drop + udp dport 5355 drop + ip saddr != { 10.50.0.0/24, 192.168.33.0/24 } tcp dport 8000 drop + } + + chain forward { + type filter hook forward priority filter; policy drop; + ct state { established, related } accept + iifname "wg0" oifname "enx00e04c2e4828" counter packets 0 bytes 0 accept + iifname "wg0" accept + iifname "enx00e04c2e4828" oifname "wg0" accept + iif "enx00e04c2e4828" oifname "br-*" accept + iifname "br-*" oif "enx00e04c2e4828" accept + iifname "br-*" oifname "wg0" accept + } + + chain output { + type filter hook output priority filter; policy accept; + } +} +table ip nat { + chain DOCKER { + ip daddr 10.50.0.1 iifname != "br-07462fa2c80e" tcp dport 8080 counter packets 0 bytes 0 dnat to 172.18.0.2:8080 + ip daddr 127.0.0.1 iifname != "br-454eb7778b0a" tcp dport 8081 counter packets 0 bytes 0 dnat to 172.19.0.2:8080 + iifname != "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 dnat to 172.26.0.3:5055 + iifname != "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 dnat to 172.26.0.3:8502 + ip daddr 127.0.0.1 iifname != "br-ed53bc5d2155" tcp dport 9081 counter packets 0 bytes 0 dnat to 172.20.0.2:80 + ip daddr 127.0.0.1 iifname != "br-de49ada7ecfc" tcp dport 9091 counter packets 0 bytes 0 dnat to 172.21.0.4:80 + ip daddr 127.0.0.1 iifname != "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 dnat to 172.25.0.2:9001 + iifname != "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 dnat to 172.23.0.4:8000 + ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3101 counter packets 0 bytes 0 dnat to 172.24.0.2:3000 + ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3103 counter packets 0 bytes 0 dnat to 172.24.0.2:3003 + } + + chain PREROUTING { + type nat hook prerouting priority dstnat; policy accept; + fib daddr type local counter packets 22703 bytes 1612319 jump DOCKER + } + + chain OUTPUT { + type nat hook output priority dstnat; policy accept; + ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER + } + + chain POSTROUTING { + type nat hook postrouting priority srcnat; policy accept; + ip saddr 172.23.0.0/16 oifname != "br-0a3c12139db8" counter packets 0 bytes 0 masquerade + ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade + ip saddr 172.21.0.0/16 oifname != "br-de49ada7ecfc" counter packets 0 bytes 0 masquerade + ip saddr 172.26.0.0/16 oifname != "br-3d1818651f84" counter packets 3 bytes 180 masquerade + ip saddr 172.22.0.0/16 oifname != "br-2fd0bcdb4679" counter packets 0 bytes 0 masquerade + ip saddr 172.18.0.0/16 oifname != "br-07462fa2c80e" counter packets 0 bytes 0 masquerade + ip saddr 172.20.0.0/16 oifname != "br-ed53bc5d2155" counter packets 0 bytes 0 masquerade + ip saddr 172.24.0.0/16 oifname != "br-bebca6296b94" counter packets 0 bytes 0 masquerade + ip saddr 172.25.0.0/16 oifname != "br-7ad976d6055e" counter packets 0 bytes 0 masquerade + ip saddr 172.19.0.0/16 oifname != "br-454eb7778b0a" counter packets 0 bytes 0 masquerade + } +} +table ip filter { + chain DOCKER { + ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3003 counter packets 0 bytes 0 accept + ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3000 counter packets 0 bytes 0 accept + ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 accept + ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 accept + ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" tcp dport 80 counter packets 0 bytes 0 accept + ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" tcp dport 80 counter packets 0 bytes 0 accept + ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 accept + ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 accept + ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" tcp dport 8080 counter packets 0 bytes 0 accept + ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" tcp dport 8080 counter packets 0 bytes 0 accept + iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" counter packets 0 bytes 0 drop + iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" counter packets 0 bytes 0 drop + iifname != "br-bebca6296b94" oifname "br-bebca6296b94" counter packets 0 bytes 0 drop + iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" counter packets 0 bytes 0 drop + iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" counter packets 0 bytes 0 drop + iifname != "br-2fd0bcdb4679" oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 drop + iifname != "br-3d1818651f84" oifname "br-3d1818651f84" counter packets 0 bytes 0 drop + iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" counter packets 0 bytes 0 drop + iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop + iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" counter packets 0 bytes 0 drop + } + + chain DOCKER-FORWARD { + counter packets 400 bytes 2261453 jump DOCKER-CT + counter packets 143 bytes 153471 jump DOCKER-INTERNAL + counter packets 143 bytes 153471 jump DOCKER-BRIDGE + iifname "br-454eb7778b0a" counter packets 0 bytes 0 accept + iifname "br-7ad976d6055e" counter packets 0 bytes 0 accept + iifname "br-bebca6296b94" counter packets 0 bytes 0 accept + iifname "br-ed53bc5d2155" counter packets 0 bytes 0 accept + iifname "br-07462fa2c80e" counter packets 0 bytes 0 accept + iifname "br-2fd0bcdb4679" counter packets 0 bytes 0 accept + iifname "br-3d1818651f84" counter packets 143 bytes 153471 accept + iifname "br-de49ada7ecfc" counter packets 0 bytes 0 accept + iifname "docker0" counter packets 0 bytes 0 accept + iifname "br-0a3c12139db8" counter packets 0 bytes 0 accept + } + + chain DOCKER-BRIDGE { + oifname "br-454eb7778b0a" counter packets 0 bytes 0 jump DOCKER + oifname "br-7ad976d6055e" counter packets 0 bytes 0 jump DOCKER + oifname "br-bebca6296b94" counter packets 0 bytes 0 jump DOCKER + oifname "br-ed53bc5d2155" counter packets 0 bytes 0 jump DOCKER + oifname "br-07462fa2c80e" counter packets 0 bytes 0 jump DOCKER + oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 jump DOCKER + oifname "br-3d1818651f84" counter packets 0 bytes 0 jump DOCKER + oifname "br-de49ada7ecfc" counter packets 0 bytes 0 jump DOCKER + oifname "docker0" counter packets 0 bytes 0 jump DOCKER + oifname "br-0a3c12139db8" counter packets 0 bytes 0 jump DOCKER + } + + chain DOCKER-CT { + oifname "br-454eb7778b0a" ct state related,established counter packets 0 bytes 0 accept + oifname "br-7ad976d6055e" ct state related,established counter packets 0 bytes 0 accept + oifname "br-bebca6296b94" ct state related,established counter packets 0 bytes 0 accept + oifname "br-ed53bc5d2155" ct state related,established counter packets 0 bytes 0 accept + oifname "br-07462fa2c80e" ct state related,established counter packets 0 bytes 0 accept + oifname "br-2fd0bcdb4679" ct state related,established counter packets 0 bytes 0 accept + oifname "br-3d1818651f84" ct state related,established counter packets 257 bytes 2107982 accept + oifname "br-de49ada7ecfc" ct state related,established counter packets 0 bytes 0 accept + oifname "docker0" ct state related,established counter packets 0 bytes 0 accept + oifname "br-0a3c12139db8" ct state related,established counter packets 0 bytes 0 accept + } + + chain DOCKER-INTERNAL { + } + + chain FORWARD { + type filter hook forward priority filter; policy accept; + counter packets 400 bytes 2261453 jump DOCKER-USER + counter packets 400 bytes 2261453 jump DOCKER-FORWARD + } + + chain DOCKER-USER { + } +} +table ip6 nat { + chain DOCKER { + } + + chain PREROUTING { + type nat hook prerouting priority dstnat; policy accept; + fib daddr type local counter packets 0 bytes 0 jump DOCKER + } + + chain OUTPUT { + type nat hook output priority dstnat; policy accept; + ip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER + } +} +table ip6 filter { + chain DOCKER { + } + + chain DOCKER-FORWARD { + counter packets 0 bytes 0 jump DOCKER-CT + counter packets 0 bytes 0 jump DOCKER-INTERNAL + counter packets 0 bytes 0 jump DOCKER-BRIDGE + } + + chain DOCKER-BRIDGE { + } + + chain DOCKER-CT { + } + + chain DOCKER-INTERNAL { + } + + chain FORWARD { + type filter hook forward priority filter; policy accept; + counter packets 0 bytes 0 jump DOCKER-USER + counter packets 0 bytes 0 jump DOCKER-FORWARD + } + + chain DOCKER-USER { + } +} +table ip raw { + chain PREROUTING { + type filter hook prerouting priority raw; policy accept; + ip daddr 172.21.0.2 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop + ip daddr 172.26.0.2 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop + ip daddr 172.21.0.3 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop + ip daddr 172.26.0.3 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop + ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" counter packets 0 bytes 0 drop + ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" counter packets 0 bytes 0 drop + ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" counter packets 0 bytes 0 drop + ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop + ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" counter packets 0 bytes 0 drop + ip daddr 127.0.0.1 iifname != "lo" tcp dport 8081 counter packets 0 bytes 0 drop + ip daddr 127.0.0.1 iifname != "lo" tcp dport 9081 counter packets 0 bytes 0 drop + ip daddr 127.0.0.1 iifname != "lo" tcp dport 9091 counter packets 0 bytes 0 drop + ip daddr 127.0.0.1 iifname != "lo" tcp dport 9001 counter packets 0 bytes 0 drop + ip daddr 172.23.0.2 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop + ip daddr 172.23.0.3 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop + ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop + ip daddr 172.24.0.2 iifname != "br-bebca6296b94" counter packets 0 bytes 0 drop + ip daddr 127.0.0.1 iifname != "lo" tcp dport 3101 counter packets 0 bytes 0 drop + ip daddr 127.0.0.1 iifname != "lo" tcp dport 3103 counter packets 0 bytes 0 drop + ip daddr 127.0.0.1 iifname != "lo" tcp dport 8000 ip saddr != 192.168.33.0/24 counter packets 0 bytes 0 drop + } +} +table inet f2b-table { + set addr-set-sshd { + type ipv4_addr + flags interval + } + + chain f2b-chain { + type filter hook input priority filter - 1; policy accept; + meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable + } +} -- cgit v1.3