collabvm/nftables
8
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix patch (2)

Browse source
This commit is contained in:
root 2024-03-30 13:06:47 -04:00
parent 98bd0b6f63
commit e72af51b01
2 changed files with 13 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
blocklist.nft
View file

@ -197,4 +197,5 @@ define blocklist = {
199.229.252.121,
86.162.6.84,
87.3.215.35,
141.8.192.26,
}

10
nftables.patch
View file

@ -1,5 +1,5 @@
--- nftables.conf 2023-06-10 01:16:58.000000000 +0200
+++ nftables.conf.2 2024-03-30 17:53:25.967805988 +0100
+++ /etc/nftables.conf 2024-03-30 18:04:11.549553009 +0100
@@ -1,5 +1,6 @@
#!/usr/sbin/nft -f
flush ruleset
@ -19,7 +19,7 @@
chain forward {
type filter hook forward priority filter; policy drop;
@@ -32,12 +38,16 @@
@@ -32,12 +38,15 @@
# Accept LAN<->WAN traffic
meta iifname $LAN meta oifname $WAN accept
meta iifname $WAN meta oifname $LAN accept
@ -33,12 +33,11 @@
+ udp dport 443 log prefix "Dropped (UDP/443): " drop
+ meta iifname $LAN ip daddr @blocklist log prefix "Dropped (BLOCKED IP): " drop
+ meta iifname $LAN ip saddr @blocklist log prefix "Dropped (BLOCKED IP): " drop
+
+
# Block all DNS resolvers beside the router
th dport 53 ip saddr $LANRANGE ip daddr != 192.168.1.1 log prefix "Dropped (DNS): " reject
# Block access to the SLiRP gateway
@@ -48,6 +58,13 @@
@@ -48,6 +57,12 @@
}
table inet nat {
@ -47,12 +46,11 @@
+ flags interval
+ elements = { $blocklist }
+ }
+
+
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
meta iifname $LAN meta oifname $WAN ip saddr $LANRANGE snat ip to $SNAT
@@ -55,7 +72,7 @@
@@ -55,7 +70,7 @@
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
# Uncomment for E2Guardian