Simple ruleset for a workstation - Revision history

Hauptmann: Pages using deprecated source tags

2021-12-08T22:51:34Z

Pages using deprecated source tags

← Older revision		Revision as of 22:51, 8 December 2021
Line 7:		Line 7:
	For IPv4 only workstation.		For IPv4 only workstation.

	<~~source~~ lang="bash">		<syntaxhighlight lang="bash">
	flush ruleset		flush ruleset

Line 21:		Line 21:
	}		}
	}		}
	</~~source~~>		</syntaxhighlight>

	= fw6.basic =		= fw6.basic =
Line 27:		Line 27:
	For IPv6 only workstation.		For IPv6 only workstation.

	<~~source~~ lang="bash">		<syntaxhighlight lang="bash">
	flush ruleset		flush ruleset

Line 44:		Line 44:
	}		}
	}		}
	</~~source~~>		</syntaxhighlight>

	= fw.inet.basic =		= fw.inet.basic =
Line 50:		Line 50:
	For dual-stack IPv4/IPv6 workstation.		For dual-stack IPv4/IPv6 workstation.

	<~~source~~ lang="bash">		<syntaxhighlight lang="bash">
	flush ruleset		flush ruleset

Line 68:		Line 68:
	}		}
	}		}
	</~~source~~>		</syntaxhighlight>

Pablo: remove echo request in IPv6 examples

2021-08-12T08:33:13Z

remove echo request in IPv6 examples

← Older revision		Revision as of 08:33, 12 August 2021
Line 41:		Line 41:

	# accept neighbour discovery otherwise connectivity breaks		# accept neighbour discovery otherwise connectivity breaks
	icmpv6 type { nd-neighbor-solicit~~, echo-request~~, nd-router-advert, nd-neighbor-advert } accept		icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
	}		}
	}		}
Line 64:		Line 64:

	# accept neighbour discovery otherwise IPv6 connectivity breaks		# accept neighbour discovery otherwise IPv6 connectivity breaks
	icmpv6 type { nd-neighbor-solicit~~, echo-request~~, nd-router-advert, nd-neighbor-advert } accept		icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept

	}		}
	}		}
	</source>		</source>

Hauptmann: add flush ruleset

2021-08-11T05:14:56Z

add flush ruleset

← Older revision		Revision as of 05:14, 11 August 2021
Line 1:		Line 1:
	A very simple set of rules that allows you to initiate communications from your workstation to the Internet but restricts any communication initiation to your workstation (that was not initiated by you).		A very simple set of rules that allows you to initiate communications from your workstation to the Internet but restricts any communication initiation to your workstation (that was not initiated by you).

			You can load this file with nft -f.

	= fw.basic =		= fw.basic =
Line 6:		Line 8:

	<source lang="bash">		<source lang="bash">
			flush ruleset

	table ip filter {		table ip filter {
	chain input {		chain input {
Line 24:		Line 28:

	<source lang="bash">		<source lang="bash">
			flush ruleset

	table ip6 filter {		table ip6 filter {
	chain input {		chain input {
Line 45:		Line 51:

	<source lang="bash">		<source lang="bash">
			flush ruleset

	table inet filter {		table inet filter {
	chain input {		chain input {

Hauptmann: use policy and more comments

2021-08-11T05:12:51Z

use policy and more comments

← Older revision		Revision as of 05:12, 11 August 2021
Line 1:		Line 1:
			A very simple set of rules that allows you to initiate communications from your workstation to the Internet but restricts any communication initiation to your workstation (that was not initiated by you).

	= fw.basic =		= fw.basic =

Line 6:		Line 8:
	table ip filter {		table ip filter {
	chain input {		chain input {
	type filter hook input priority 0;		type filter hook input priority 0; policy drop;

	# accept traffic originated from us		# accept traffic originated from us
Line 13:		Line 15:
	# accept any localhost traffic		# accept any localhost traffic
	iif lo accept		iif lo accept

	~~# count and drop any other traffic~~
	~~counter drop~~
	}		}
	}		}
Line 27:		Line 26:
	table ip6 filter {		table ip6 filter {
	chain input {		chain input {
	type filter hook input priority 0;		type filter hook input priority 0; policy drop;

	# accept any localhost traffic		# accept any localhost traffic
Line 37:		Line 36:
	# accept neighbour discovery otherwise connectivity breaks		# accept neighbour discovery otherwise connectivity breaks
	icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept		icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept

	~~# count and drop any other traffic~~
	~~counter drop~~
	}		}
	}		}
Line 51:		Line 47:
	table inet filter {		table inet filter {
	chain input {		chain input {
	type filter hook input priority 0;		type filter hook input priority 0; policy drop;

	# accept any localhost traffic		# accept any localhost traffic
Line 62:		Line 58:
	icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept		icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept

	~~# count and drop any other traffic~~
	~~counter drop~~
	}		}
	}		}
	</source>		</source>

Hauptmann at 05:08, 11 August 2021

2021-08-11T05:08:15Z

← Older revision		Revision as of 05:08, 11 August 2021
Line 1:		Line 1:
	= fw.basic =		= fw.basic =

			For IPv4 only workstation.

	<source lang="bash">		<source lang="bash">
Line 19:		Line 21:

	= fw6.basic =		= fw6.basic =

			For IPv6 only workstation.

	<source lang="bash">		<source lang="bash">
Line 42:		Line 46:
	= fw.inet.basic =		= fw.inet.basic =

	~~The inet table is available from Linux kernel 3.14 and allow to use a~~ dual-stack IPv4/IPv6 ~~table. There is mostly a~~		For dual-stack IPv4/IPv6 workstation.
	~~single change compared to previous ruleset which is the ''inet'' keyword~~.

	<source lang="bash">		<source lang="bash">
Line 56:		Line 59:
	ct state established,related accept		ct state established,related accept

	# accept neighbour discovery otherwise connectivity breaks		# accept neighbour discovery otherwise IPv6 connectivity breaks
	~~ip6 nexthdr icmpv6~~ icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept		icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept

	# count and drop any other traffic		# count and drop any other traffic

Hauptmann: /* fw.basic */ not here

2021-08-11T04:42:20Z

fw.basic: not here

@@ Line 11: / Line 11: @@
            # accept any localhost traffic
            iif lo accept
            # count and drop any other traffic

Hauptmann: /* fw.basic */

2021-08-11T04:41:07Z

fw.basic

← Older revision		Revision as of 04:41, 11 August 2021
Line 12:		Line 12:
	iif lo accept		iif lo accept

	# ~~Accepting~~ ping (icmp-echo-request) can be nice for diagnostic purposes.		# accepting ping (icmp-echo-request) can be nice for diagnostic purposes.
	# However, it also lets probes discover this host is alive.		# However, it also lets probes discover this host is alive.
	# This sample accepts them within a certain rate limit:		# This sample accepts them within a certain rate limit:
			#
	# icmp type echo-request limit rate 5/second packets accept		# icmp type echo-request limit rate 5/second packets accept

			# examples for opening service-specific ports:
			# ct state new tcp dport 22 accept
			# ct state new tcp dport { 80,443 } accept

	# count and drop any other traffic		# count and drop any other traffic

Hauptmann: /* fw.basic */ von https://github.com/QueuingKoala/netfilter-samples/

2021-08-11T04:39:25Z

fw.basic: von https://github.com/QueuingKoala/netfilter-samples/

← Older revision		Revision as of 04:39, 11 August 2021
Line 11:		Line 11:
	# accept any localhost traffic		# accept any localhost traffic
	iif lo accept		iif lo accept

			# Accepting ping (icmp-echo-request) can be nice for diagnostic purposes.
			# However, it also lets probes discover this host is alive.
			# This sample accepts them within a certain rate limit:
			# icmp type echo-request limit rate 5/second packets accept

	# count and drop any other traffic		# count and drop any other traffic

Arturo: /* fw.inet.basic */ clarify dual stack

2017-09-13T11:29:59Z

fw.inet.basic: clarify dual stack

← Older revision		Revision as of 11:29, 13 September 2017
Line 42:		Line 42:
	= fw.inet.basic =		= fw.inet.basic =

	The inet table is available from Linux kernel 3.14 and allow to ~~make an~~ IPv4 ~~and~~ IPv6 table. There is mostly a		The inet table is available from Linux kernel 3.14 and allow to use a dual-stack IPv4/IPv6 table. There is mostly a
	single change compared to previous ruleset which is the ''inet'' keyword.		single change compared to previous ruleset which is the ''inet'' keyword.

Arturo: /* fw.inet.basic */ drop misleading comment

2016-12-15T15:32:37Z

fw.inet.basic: drop misleading comment

← Older revision		Revision as of 15:32, 15 December 2016
Line 56:		Line 56:
	ct state established,related accept		ct state established,related accept

	# accept neighbour discovery otherwise connectivity breaks~~. daddr filter is a workaround to set l3 protocol.~~		# accept neighbour discovery otherwise connectivity breaks
	ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept		ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept