63 lines
2.4 KiB
Diff
63 lines
2.4 KiB
Diff
--- nftables.conf 2023-06-10 01:16:58.000000000 +0200
|
|
+++ /etc/nftables.conf 2024-03-30 18:04:11.549553009 +0100
|
|
@@ -1,5 +1,6 @@
|
|
#!/usr/sbin/nft -f
|
|
flush ruleset
|
|
+include "/etc/nftables.d/blocklist.nft"
|
|
|
|
# SET TO WIREGUARD INTERFACE IP
|
|
define SNAT = 192.168.1.1
|
|
@@ -22,6 +23,11 @@
|
|
|
|
|
|
table inet filter {
|
|
+ set blocklist {
|
|
+ type ipv4_addr
|
|
+ flags interval
|
|
+ elements = { $blocklist }
|
|
+ }
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop;
|
|
@@ -32,12 +38,15 @@
|
|
# Accept LAN<->WAN traffic
|
|
meta iifname $LAN meta oifname $WAN accept
|
|
meta iifname $WAN meta oifname $LAN accept
|
|
- udp dport 80 log prefix "Dropped (UDP/80): " drop
|
|
- udp dport 443 log prefix "Dropped (UDP/443): " drop
|
|
ct state related,established accept
|
|
log prefix "Packet discarded by policy: "
|
|
}
|
|
chain noforward {
|
|
+ udp dport 80 log prefix "Dropped (UDP/80): " drop
|
|
+ udp dport 443 log prefix "Dropped (UDP/443): " drop
|
|
+ meta iifname $LAN ip daddr @blocklist log prefix "Dropped (BLOCKED IP): " drop
|
|
+ meta iifname $LAN ip saddr @blocklist log prefix "Dropped (BLOCKED IP): " drop
|
|
+
|
|
# Block all DNS resolvers beside the router
|
|
th dport 53 ip saddr $LANRANGE ip daddr != 192.168.1.1 log prefix "Dropped (DNS): " reject
|
|
# Block access to the SLiRP gateway
|
|
@@ -48,6 +57,12 @@
|
|
}
|
|
|
|
table inet nat {
|
|
+ set blocklist {
|
|
+ type ipv4_addr
|
|
+ flags interval
|
|
+ elements = { $blocklist }
|
|
+ }
|
|
+
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
meta iifname $LAN meta oifname $WAN ip saddr $LANRANGE snat ip to $SNAT
|
|
@@ -55,7 +70,7 @@
|
|
chain prerouting {
|
|
type nat hook prerouting priority dstnat; policy accept;
|
|
# Uncomment for E2Guardian
|
|
- # iifname $LAN ip daddr != 192.168.1.0/24 tcp dport 80 redirect to :8080
|
|
- # iifname $LAN ip daddr != 192.168.1.0/24 tcp dport 443 redirect to :8443
|
|
+ iifname $LAN ip daddr != $LANRANGE ip daddr != @blocklist tcp dport 80 redirect to :8080
|
|
+ iifname $LAN ip daddr != $LANRANGE ip daddr != @blocklist tcp dport 443 redirect to :8443
|
|
}
|
|
}
|