Nftables Webserver - Versionsgeschichte

Martin Kirner am 16. Juli 2023 um 11:23 Uhr

2023-07-16T11:23:29Z

← Nächstältere Version		Version vom 16. Juli 2023, 13:23 Uhr
Zeile 1:		Zeile 1:
	{{~~note\|Noch in Bearbeitung~~}}		== Stand 16.07.2023 ==

			<pre>
			#!/usr/sbin/nft -f

			flush ruleset

			#include "/etc/nftables/fail2ban.conf"

			table inet filter {
			set internal_networks_ip4 {
			type ipv4_addr
			flags interval
			auto-merge
			elements = { 10.3.0.0/24, 10.2.0.0/24, 10.0.0.0/24, 10.8.4.0-10.8.8.255 }
			}

			chain input {
			type filter hook input priority 0; policy drop;

			# established/related connections
			ct state established,related accept;

			# loopback interface
			iifname lo accept;

			# icmp (ping)
			iifname "wlan0" icmp type echo-request accept;
			iifname "tun0" icmp type echo-request accept;
			iifname "eth0" ip daddr { 212.186.198.10 } icmp type echo-request accept;
			iifname "eth1" icmp type echo-request accept;

			# open sshd (22) for internal networks only
			tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"

			# open tcp ports: http (80), https (443)
			tcp dport { http, https } accept;

			# open udp ports: domain (53), openvpn (1194)
			udp dport { domain, openvpn } accept;

			# mysql (3306)
			meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

			# iperf (5201)
			tcp dport { 5201 } accept;

			counter comment "count dropped packets"
			#log
			}

			chain forward {
			type filter hook forward priority 0; policy drop;

			ip saddr @internal_networks_ip4 accept;
			iifname "wlan0" oifname "tun0" ct state related,established accept;
			iifname "eth0" oifname "tun0" ct state related,established accept;
			iifname "eth1" oifname "tun0" ct state related,established accept;
			}

			chain output {
			type filter hook output priority 0; policy accept;
			}
			}

			# NAT
			table ip nat {
			chain prerouting {
			type nat hook prerouting priority 0; policy accept;
			}

			# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
			chain postrouting {
			type nat hook postrouting priority 100; policy accept;
			oifname "wlan0" ip saddr 10.8.8.0/24 masquerade;
			oifname "eth0" ip saddr 10.8.8.0/24 masquerade;
			oifname "eth1" ip saddr 10.8.8.0/24 masquerade;
			}
			}
			</pre>

	== Stand 07.08.2020 ==		== Stand 07.08.2020 ==

Martin Kirner am 7. August 2020 um 13:00 Uhr

2020-08-07T13:00:26Z

← Nächstältere Version		Version vom 7. August 2020, 15:00 Uhr
Zeile 8:		Zeile 8:
	flush ruleset		flush ruleset

	include "/etc/nftables/fail2ban.conf"		#include "/etc/nftables/fail2ban.conf"

	table inet filter {		table inet filter {

Martin Kirner: /* Stand 07.08.2020 */

2020-08-07T13:00:00Z

Stand 07.08.2020

← Nächstältere Version		Version vom 7. August 2020, 15:00 Uhr
Zeile 15:		Zeile 15:
	flags interval		flags interval
	auto-merge		auto-merge
	elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.4.0/24 }		elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.8.0/24 }
	}		}

Zeile 30:		Zeile 30:
	iifname "wlan0" icmp type echo-request accept;		iifname "wlan0" icmp type echo-request accept;
	iifname "tun0" icmp type echo-request accept;		iifname "tun0" icmp type echo-request accept;
	iifname "eth0" ip daddr { 212.186.198.11 } icmp type echo-request accept;		iifname "eth0" ip daddr { 212.186.198.10 } icmp type echo-request accept;

	# open sshd (22) for internal networks only		# open sshd (22) for internal networks only
Zeile 40:		Zeile 40:
	# open udp ports: domain (53), openvpn (1194)		# open udp ports: domain (53), openvpn (1194)
	udp dport { domain, openvpn } accept;		udp dport { domain, openvpn } accept;

	~~# mail ports: pop3 (143), imap (110), submission (SMTP/587), smtp (25), doveadm (47111)~~
	~~tcp dport { pop3, imap2, submission, smtp, 47111 } accept;~~
	~~udp dport { imap2 } accept;~~

	# mysql (3306)		# mysql (3306)
Zeile 75:		Zeile 71:
	chain postrouting {		chain postrouting {
	type nat hook postrouting priority 100; policy accept;		type nat hook postrouting priority 100; policy accept;
	oifname "wlan0" ip saddr 10.8.4.0/24 masquerade;		oifname "wlan0" ip saddr 10.8.8.0/24 masquerade;
	oifname "eth0" ip saddr 10.8.4.0/24 masquerade;		oifname "eth0" ip saddr 10.8.8.0/24 masquerade;
	}		}
	}		}

Martin Kirner: Die Seite wurde neu angelegt: „{{note|Noch in Bearbeitung}} == Stand 07.08.2020 ==

 #!/usr/sbin/nft -f  flush ruleset  include "/etc/nftables/fail2ban.conf"  table inet filter {   set…“

2020-08-07T12:56:31Z

Die Seite wurde neu angelegt: „{{note|Noch in Bearbeitung}} == Stand 07.08.2020 == <pre> #!/usr/sbin/nft -f flush ruleset include "/etc/nftables/fail2ban.conf" table inet filter { set…“

Neue Seite

{{note|Noch in Bearbeitung}}

== Stand 07.08.2020 ==

<pre>
#!/usr/sbin/nft -f

flush ruleset

include "/etc/nftables/fail2ban.conf"

table inet filter {
set internal_networks_ip4 {
type ipv4_addr
flags interval
auto-merge
elements = { 10.2.0.0/24, 10.0.0.0/24, 10.8.4.0/24 }
}

chain input {
type filter hook input priority 0; policy drop;

# established/related connections
ct state established,related accept;

# loopback interface
iifname lo accept;

# icmp (ping)
iifname "wlan0" icmp type echo-request accept;
iifname "tun0" icmp type echo-request accept;
iifname "eth0" ip daddr { 212.186.198.11 } icmp type echo-request accept;

# open sshd (22) for internal networks only
tcp dport { ssh } ip saddr @internal_networks_ip4 accept comment "accept SSH from internal networks"

# open tcp ports: http (80), https (443)
tcp dport { http, https } accept;

# open udp ports: domain (53), openvpn (1194)
udp dport { domain, openvpn } accept;

# mail ports: pop3 (143), imap (110), submission (SMTP/587), smtp (25), doveadm (47111)
tcp dport { pop3, imap2, submission, smtp, 47111 } accept;
udp dport { imap2 } accept;

# mysql (3306)
meta l4proto { tcp, udp } @th,16,16 { 3306 } ip saddr @internal_networks_ip4 accept comment "accept mysql from internal networks";

counter comment "count dropped packets"
#log
}

chain forward {
type filter hook forward priority 0; policy drop;

ip saddr @internal_networks_ip4 accept;
iifname "wlan0" oifname "tun0" ct state related,established accept;
iifname "eth0" oifname "tun0" ct state related,established accept;
}

chain output {
type filter hook output priority 0; policy accept;
}
}

# NAT
table ip nat {
chain prerouting {
type nat hook prerouting priority 0; policy accept;
}

# for all packets to WAN, after routing, replace source address with primary IP of WAN interface
chain postrouting {
type nat hook postrouting priority 100; policy accept;
oifname "wlan0" ip saddr 10.8.4.0/24 masquerade;
oifname "eth0" ip saddr 10.8.4.0/24 masquerade;
}
}
</pre>

Zurück zu [[Nftables_(Linux)#Beispielkonfigurationen|nftables]]