1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
|
table inet nat {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "enx00e04c2e4828" ip saddr 10.50.0.0/24 counter packets 0 bytes 0 masquerade
}
}
table inet filter {
chain input {
type filter hook input priority filter; policy drop;
iif "lo" accept
ct state invalid drop
ct state { established, related } accept
ip saddr 10.50.0.0/24 udp dport 53 accept
ip saddr 10.50.0.0/24 tcp dport 53 accept
ip saddr 192.168.33.0/24 udp dport 53 accept
ip saddr 192.168.33.0/24 tcp dport 53 accept
ip saddr 172.22.0.0/16 udp dport 53 accept
ip saddr 172.22.0.0/16 tcp dport 53 accept
ip protocol icmp accept
ip6 nexthdr ipv6-icmp accept
ip saddr 192.168.33.0/24 tcp dport 2222 ct state new accept
iifname "wg0" tcp dport 2222 ct state new accept
iifname "wg0" tcp dport 8080 ct state new accept
iifname "wg0" tcp dport 3000 ct state new accept
iifname "wg0" tcp dport { 3001, 8002 } ct state new accept
iifname "wg0" tcp dport 3300 ct state new accept
udp dport 52220 accept
udp sport 67 udp dport 68 accept
ip saddr 192.168.33.0/24 tcp dport 57385 ct state new limit rate 15/minute burst 5 packets counter packets 24 bytes 1440 accept
ip saddr 192.168.33.0/24 tcp dport 8000 ct state new counter packets 0 bytes 0 accept
tcp dport 57385 ct state new limit rate 30/minute burst 20 packets counter packets 7285 bytes 439500 accept
tcp dport { 443, 9080 } ct state new accept
ct state new tcp dport 52220 accept
ct state new tcp dport 52690 accept
tcp dport 64738 ct state new accept
udp dport 64738 accept
tcp dport 1965 ct state new accept
tcp dport 70 ct state new accept
counter packets 100331 bytes 24311938 drop
ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 5055, 8502 } ct state new accept
ip saddr { 10.50.0.0/24, 192.168.33.0/24 } tcp dport { 3100, 9090, 9095, 9096, 9100, 9516 } ct state new accept
ip saddr 192.168.33.0/24 tcp dport 3300 ct state new accept
tcp dport 5355 drop
udp dport 5355 drop
ip saddr != { 10.50.0.0/24, 192.168.33.0/24 } tcp dport 8000 drop
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state { established, related } accept
iifname "wg0" oifname "enx00e04c2e4828" counter packets 0 bytes 0 accept
iifname "wg0" accept
iifname "enx00e04c2e4828" oifname "wg0" accept
iif "enx00e04c2e4828" oifname "br-*" accept
iifname "br-*" oif "enx00e04c2e4828" accept
iifname "br-*" oifname "wg0" accept
}
chain output {
type filter hook output priority filter; policy accept;
}
}
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
chain DOCKER {
ip daddr 10.50.0.1 iifname != "br-07462fa2c80e" tcp dport 8080 counter packets 4430 bytes 265800 dnat to 172.18.0.2:8080
ip daddr 127.0.0.1 iifname != "br-454eb7778b0a" tcp dport 8081 counter packets 0 bytes 0 dnat to 172.19.0.2:8080
iifname != "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 dnat to 172.26.0.3:5055
iifname != "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 dnat to 172.26.0.3:8502
ip daddr 127.0.0.1 iifname != "br-ed53bc5d2155" tcp dport 9081 counter packets 0 bytes 0 dnat to 172.20.0.2:80
ip daddr 127.0.0.1 iifname != "br-de49ada7ecfc" tcp dport 9091 counter packets 0 bytes 0 dnat to 172.21.0.4:80
ip daddr 127.0.0.1 iifname != "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 dnat to 172.25.0.2:9001
iifname != "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 dnat to 172.23.0.4:8000
ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3101 counter packets 0 bytes 0 dnat to 172.24.0.2:3000
ip daddr 127.0.0.1 iifname != "br-bebca6296b94" tcp dport 3103 counter packets 0 bytes 0 dnat to 172.24.0.2:3003
iifname != "br-8f7fc81a0600" tcp dport 2222 counter packets 9 bytes 540 dnat to 172.30.0.2:22
iifname != "br-8f7fc81a0600" tcp dport 3300 counter packets 318 bytes 19080 dnat to 172.30.0.2:3000
ip daddr 10.50.0.1 iifname != "br-e2d8a9eac20e" tcp dport 3001 counter packets 19 bytes 1138 dnat to 172.22.0.2:3001
}
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
fib daddr type local counter packets 249517 bytes 32928887 jump DOCKER
}
chain OUTPUT {
type nat hook output priority dstnat; policy accept;
ip daddr != 127.0.0.0/8 fib daddr type local counter packets 5296 bytes 317760 jump DOCKER
}
chain POSTROUTING {
type nat hook postrouting priority srcnat; policy accept;
ip saddr 172.23.0.0/16 oifname != "br-0a3c12139db8" counter packets 0 bytes 0 masquerade
ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
ip saddr 172.21.0.0/16 oifname != "br-de49ada7ecfc" counter packets 6 bytes 360 masquerade
ip saddr 172.26.0.0/16 oifname != "br-3d1818651f84" counter packets 3 bytes 180 masquerade
ip saddr 172.22.0.0/16 oifname != "br-2fd0bcdb4679" counter packets 32880 bytes 2067095 masquerade
ip saddr 172.18.0.0/16 oifname != "br-07462fa2c80e" counter packets 287 bytes 17220 masquerade
ip saddr 172.20.0.0/16 oifname != "br-ed53bc5d2155" counter packets 2 bytes 120 masquerade
ip saddr 172.24.0.0/16 oifname != "br-bebca6296b94" counter packets 3 bytes 180 masquerade
ip saddr 172.25.0.0/16 oifname != "br-7ad976d6055e" counter packets 0 bytes 0 masquerade
ip saddr 172.19.0.0/16 oifname != "br-454eb7778b0a" counter packets 0 bytes 0 masquerade
}
}
table ip filter {
chain DOCKER {
ip daddr 172.22.0.2 iifname != "br-e2d8a9eac20e" oifname "br-e2d8a9eac20e" tcp dport 3001 counter packets 0 bytes 0 accept
ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" oifname "br-8f7fc81a0600" tcp dport 3000 counter packets 0 bytes 0 accept
ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" oifname "br-8f7fc81a0600" tcp dport 22 counter packets 0 bytes 0 accept
ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3003 counter packets 0 bytes 0 accept
ip daddr 172.24.0.2 iifname != "br-bebca6296b94" oifname "br-bebca6296b94" tcp dport 3000 counter packets 0 bytes 0 accept
ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" tcp dport 8000 counter packets 0 bytes 0 accept
ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" tcp dport 9001 counter packets 0 bytes 0 accept
ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" tcp dport 80 counter packets 0 bytes 0 accept
ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" tcp dport 80 counter packets 0 bytes 0 accept
ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 8502 counter packets 0 bytes 0 accept
ip daddr 172.26.0.3 iifname != "br-3d1818651f84" oifname "br-3d1818651f84" tcp dport 5055 counter packets 0 bytes 0 accept
ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" tcp dport 8080 counter packets 0 bytes 0 accept
ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" tcp dport 8080 counter packets 0 bytes 0 accept
iifname != "br-454eb7778b0a" oifname "br-454eb7778b0a" counter packets 0 bytes 0 drop
iifname != "br-7ad976d6055e" oifname "br-7ad976d6055e" counter packets 0 bytes 0 drop
iifname != "br-bebca6296b94" oifname "br-bebca6296b94" counter packets 0 bytes 0 drop
iifname != "br-ed53bc5d2155" oifname "br-ed53bc5d2155" counter packets 0 bytes 0 drop
iifname != "br-07462fa2c80e" oifname "br-07462fa2c80e" counter packets 0 bytes 0 drop
iifname != "br-2fd0bcdb4679" oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 drop
iifname != "br-3d1818651f84" oifname "br-3d1818651f84" counter packets 0 bytes 0 drop
iifname != "br-de49ada7ecfc" oifname "br-de49ada7ecfc" counter packets 0 bytes 0 drop
iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop
iifname != "br-0a3c12139db8" oifname "br-0a3c12139db8" counter packets 0 bytes 0 drop
}
chain DOCKER-FORWARD {
counter packets 1321965 bytes 698498753 jump DOCKER-CT
counter packets 1307852 bytes 661726331 jump DOCKER-INTERNAL
counter packets 1307852 bytes 661726331 jump DOCKER-BRIDGE
iifname "br-454eb7778b0a" counter packets 0 bytes 0 accept
iifname "br-7ad976d6055e" counter packets 0 bytes 0 accept
iifname "br-bebca6296b94" counter packets 40 bytes 8333 accept
iifname "br-ed53bc5d2155" counter packets 37 bytes 4045 accept
iifname "br-07462fa2c80e" counter packets 7631 bytes 1205643 accept
iifname "br-2fd0bcdb4679" counter packets 0 bytes 0 accept
iifname "br-3d1818651f84" counter packets 143 bytes 153471 accept
iifname "br-de49ada7ecfc" counter packets 2928 bytes 163686 accept
iifname "docker0" counter packets 0 bytes 0 accept
iifname "br-0a3c12139db8" counter packets 0 bytes 0 accept
}
chain DOCKER-BRIDGE {
oifname "br-454eb7778b0a" counter packets 0 bytes 0 jump DOCKER
oifname "br-7ad976d6055e" counter packets 0 bytes 0 jump DOCKER
oifname "br-bebca6296b94" counter packets 0 bytes 0 jump DOCKER
oifname "br-ed53bc5d2155" counter packets 0 bytes 0 jump DOCKER
oifname "br-07462fa2c80e" counter packets 0 bytes 0 jump DOCKER
oifname "br-2fd0bcdb4679" counter packets 0 bytes 0 jump DOCKER
oifname "br-3d1818651f84" counter packets 0 bytes 0 jump DOCKER
oifname "br-de49ada7ecfc" counter packets 0 bytes 0 jump DOCKER
oifname "docker0" counter packets 0 bytes 0 jump DOCKER
oifname "br-0a3c12139db8" counter packets 0 bytes 0 jump DOCKER
}
chain DOCKER-CT {
oifname "br-454eb7778b0a" ct state established,related counter packets 0 bytes 0 accept
oifname "br-7ad976d6055e" ct state established,related counter packets 0 bytes 0 accept
oifname "br-bebca6296b94" ct state established,related counter packets 37 bytes 12496 accept
oifname "br-ed53bc5d2155" ct state established,related counter packets 33 bytes 25191 accept
oifname "br-07462fa2c80e" ct state established,related counter packets 9081 bytes 12474633 accept
oifname "br-2fd0bcdb4679" ct state established,related counter packets 0 bytes 0 accept
oifname "br-3d1818651f84" ct state established,related counter packets 257 bytes 2107982 accept
oifname "br-de49ada7ecfc" ct state established,related counter packets 4705 bytes 22152120 accept
oifname "docker0" ct state established,related counter packets 0 bytes 0 accept
oifname "br-0a3c12139db8" ct state established,related counter packets 0 bytes 0 accept
}
chain DOCKER-INTERNAL {
}
chain FORWARD {
type filter hook forward priority filter; policy accept;
counter packets 1321965 bytes 698498753 jump DOCKER-USER
counter packets 1321965 bytes 698498753 jump DOCKER-FORWARD
}
chain DOCKER-USER {
}
}
table ip6 nat {
chain DOCKER {
}
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
fib daddr type local counter packets 0 bytes 0 jump DOCKER
}
chain OUTPUT {
type nat hook output priority dstnat; policy accept;
ip6 daddr != ::1 fib daddr type local counter packets 0 bytes 0 jump DOCKER
}
}
table ip6 filter {
chain DOCKER {
}
chain DOCKER-FORWARD {
counter packets 0 bytes 0 jump DOCKER-CT
counter packets 0 bytes 0 jump DOCKER-INTERNAL
counter packets 0 bytes 0 jump DOCKER-BRIDGE
}
chain DOCKER-BRIDGE {
}
chain DOCKER-CT {
}
chain DOCKER-INTERNAL {
}
chain FORWARD {
type filter hook forward priority filter; policy accept;
counter packets 0 bytes 0 jump DOCKER-USER
counter packets 0 bytes 0 jump DOCKER-FORWARD
}
chain DOCKER-USER {
}
}
table ip raw {
chain PREROUTING {
type filter hook prerouting priority raw; policy accept;
ip daddr 172.21.0.2 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
ip daddr 172.26.0.2 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop
ip daddr 172.21.0.3 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
ip daddr 172.26.0.3 iifname != "br-3d1818651f84" counter packets 0 bytes 0 drop
ip daddr 172.18.0.2 iifname != "br-07462fa2c80e" counter packets 0 bytes 0 drop
ip daddr 172.19.0.2 iifname != "br-454eb7778b0a" counter packets 0 bytes 0 drop
ip daddr 172.20.0.2 iifname != "br-ed53bc5d2155" counter packets 0 bytes 0 drop
ip daddr 172.21.0.4 iifname != "br-de49ada7ecfc" counter packets 0 bytes 0 drop
ip daddr 172.25.0.2 iifname != "br-7ad976d6055e" counter packets 0 bytes 0 drop
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8081 counter packets 0 bytes 0 drop
ip daddr 127.0.0.1 iifname != "lo" tcp dport 9081 counter packets 0 bytes 0 drop
ip daddr 127.0.0.1 iifname != "lo" tcp dport 9091 counter packets 0 bytes 0 drop
ip daddr 127.0.0.1 iifname != "lo" tcp dport 9001 counter packets 0 bytes 0 drop
ip daddr 172.23.0.2 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
ip daddr 172.23.0.3 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
ip daddr 172.23.0.4 iifname != "br-0a3c12139db8" counter packets 0 bytes 0 drop
ip daddr 172.24.0.2 iifname != "br-bebca6296b94" counter packets 0 bytes 0 drop
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3101 counter packets 0 bytes 0 drop
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3103 counter packets 0 bytes 0 drop
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8000 ip saddr != 192.168.33.0/24 counter packets 0 bytes 0 drop
ip daddr 172.30.0.2 iifname != "br-8f7fc81a0600" counter packets 0 bytes 0 drop
}
}
table inet f2b-table {
set addr-set-sshd {
type ipv4_addr
flags interval
}
chain f2b-chain {
type filter hook input priority filter - 1; policy accept;
meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable
}
}
|
