Simple ruleset for a server - Revision history

Pablo: /* nftables.conf */ missing closing curly brace

2022-01-31T17:34:46Z

nftables.conf: missing closing curly brace

← Older revision		Revision as of 17:34, 31 January 2022
Line 57:		Line 57:

	# no need to define output chain, default policy is accept if undefined.		# no need to define output chain, default policy is accept if undefined.
			}
	</syntaxhighlight>		</syntaxhighlight>

Hauptmann: Pages using deprecated source tags

2021-12-08T22:52:23Z

Pages using deprecated source tags

← Older revision		Revision as of 22:52, 8 December 2021
Line 3:		Line 3:
	= nftables.conf =		= nftables.conf =

	<~~source~~ lang="bash">		<syntaxhighlight lang="bash">
	flush ruleset		flush ruleset

Line 57:		Line 57:

	# no need to define output chain, default policy is accept if undefined.		# no need to define output chain, default policy is accept if undefined.
	</~~source~~>		</syntaxhighlight>

Hauptmann: remove burst, not required

2021-08-11T07:33:13Z

remove burst, not required

← Older revision		Revision as of 07:33, 11 August 2021
Line 13:		Line 13:
	# This sample accepts them within a certain rate limit:		# This sample accepts them within a certain rate limit:
	#		#
	# icmp type echo-request limit rate 5/second ~~burst 5 packets~~ accept		# icmp type echo-request limit rate 5/second accept
	}		}

Line 25:		Line 25:
	# This sample accepts them within a certain rate limit:		# This sample accepts them within a certain rate limit:
	#		#
	# icmpv6 type echo-request limit rate 5/second ~~burst 5 packets~~ accept		# icmpv6 type echo-request limit rate 5/second accept
	}		}

Hauptmann: /* nftables.conf */ no echo-request in neighbour discovery rule

2021-08-11T05:25:29Z

nftables.conf: no echo-request in neighbour discovery rule

← Older revision		Revision as of 05:25, 11 August 2021
Line 19:		Line 19:
	# accept neighbour discovery otherwise connectivity breaks		# accept neighbour discovery otherwise connectivity breaks
	#		#
	icmpv6 type { nd-neighbor-solicit~~, echo-request~~, nd-router-advert, nd-neighbor-advert } accept		icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept

	# accepting ping (icmpv6-echo-request) for diagnostic purposes.		# accepting ping (icmpv6-echo-request) for diagnostic purposes.

Hauptmann: update

2021-08-11T05:23:36Z

update

← Older revision		Revision as of 05:23, 11 August 2021
Line 1:		Line 1:
	Here's a very basic example ~~of the nftables.conf file you might use on~~ a web server~~. In this example~~, ~~we have~~ the ~~option to block off all incoming traffic from the server except from "safe" IP ranges. This is handy if your server is behind CloudFlare, Sucuri, or other similar traffic filtering services.~~		Here's a very basic example for a web server, you can load the ruleset file with ''nft -f''.

	'''~~Note:~~''~~' Initially, this conf allows all inbound traffic until you comment/uncomment the "From approved IP ranges only" section~~.

	= nftables.conf =		= nftables.conf =

	<source lang="bash">		<source lang="bash">
	#!/~~usr/sbin/nft -f~~		flush ruleset

			table inet firewall {

			chain inbound_ipv4 {
			# accepting ping (icmp-echo-request) for diagnostic purposes.
			# However, it also lets probes discover this host is alive.
			# This sample accepts them within a certain rate limit:
			#
			# icmp type echo-request limit rate 5/second burst 5 packets accept
			}

	~~flush ruleset~~		chain inbound_ipv6 {
			# accept neighbour discovery otherwise connectivity breaks
			#
			icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept

			# accepting ping (icmpv6-echo-request) for diagnostic purposes.
			# However, it also lets probes discover this host is alive.
			# This sample accepts them within a certain rate limit:
			#
			# icmpv6 type echo-request limit rate 5/second burst 5 packets accept
			}

	~~# List all IPs and IP ranges of your traffic filtering proxy source.~~		chain inbound {
	~~define SAFE_TRAFFIC_IPS =~~ {
	~~x.x.x.x/xx,~~
	~~x.x.x.x/xx,~~
	~~x.x.x.x,~~
	~~x.x.x.x~~
	}

	~~table inet firewall {~~		# By default, drop all traffic unless it meets a filter
			# criteria specified by the rules that follow below.
	~~chain inbound {~~

	# By default, drop all traffic unless it meets a filter
	# criteria specified by the rules that follow below.
	type filter hook input priority 0; policy drop;		type filter hook input priority 0; policy drop;

	# Allow traffic from established and related packets.		# Allow traffic from established and related packets, drop invalid
	ct state established,related accept		ct state vmap { established : accept, related : accept, invalid : drop }

	~~# Drop invalid packets.~~
	~~ct state~~ invalid drop

	# Allow loopback traffic.		# Allow loopback traffic.
	iifname lo accept		iifname lo accept

	# ~~Allow all ICMP and IGMP traffic, but enforce~~ a ~~rate limit~~		# Jump to chain according to layer 3 protocol using a verdict map
	~~# to help prevent some types of flood attacks.~~		meta protocol vmap { ip : jump inbound_ipv4, ip6 : jump inbound_ipv6 }
	~~# Allowing ICMP is mandatory for Path MTU Discovery~~
	ip ~~protocol icmp limit rate 4/second accept~~
	~~# Allowing ICMPv6 is mandatory for IPv6 to work~~
	ip6 ~~nexthdr ipv6-icmp limit rate 4/second accept~~
	~~ip protocol igmp limit rate 4/second accept~~

	# Allow SSH on port 22.		# Allow SSH on port TCP/22 and allow HTTP(S) TCP/80 and TCP/443
	~~tcp dport 22 accept~~		# for IPv4 and IPv6.
			tcp dport { 22, 80, 443} accept
	~~# Allow~~ HTTP(S).
	# ~~-- From anywhere~~
	tcp dport { ~~http~~, ~~https } accept~~
	~~udp dport { http~~, ~~https~~ } ~~accept~~
	~~# -- From approved IP ranges only~~
	~~# tcp dport { http, https } ip saddr $SAFE_TRAFFIC_IPS accept~~
	~~# udp dport { http, https } ip saddr $SAFE_TRAFFIC_IPS accept~~

	~~# Uncomment to allow incoming traffic on other ports.~~
	~~# -- Allow Jekyll dev traffic on port 4000.~~
	~~# tcp dport 4000 accept~~
	~~# -- Allow Hugo dev traffic on port 1313.~~
	~~# tcp dport 1313~~ accept

	# Uncomment to enable logging of denied inbound traffic		# Uncomment to enable logging of denied inbound traffic
	# log prefix "[nftables] Inbound Denied: " ~~flags all~~ counter drop		# log prefix "[nftables] Inbound Denied: " counter drop
			}
	}
			chain forward {
	chain forward {		# Drop everything (assumes this device is not a router)
			type filter hook forward priority 0; policy drop;
	# Drop everything (assumes this device is not a router)		}
	type filter hook forward priority 0; policy drop;
			# no need to define output chain, default policy is accept if undefined.
	~~# Uncomment to enable logging of denied forwards~~
	~~# log prefix "[nftables] Forward Denied: " flags all counter drop~~

	}

	~~chain outbound {~~

	# ~~Allow all outbound traffic~~
	~~type filter hook~~ output ~~priority 0;~~ policy accept;

	}

	}
	</source>		</source>

Pablo: /* nftables.conf */ add a note on PMTUD

2021-07-27T23:07:42Z

nftables.conf: add a note on PMTUD

← Older revision		Revision as of 23:07, 27 July 2021
Line 37:		Line 37:
	# Allow all ICMP and IGMP traffic, but enforce a rate limit		# Allow all ICMP and IGMP traffic, but enforce a rate limit
	# to help prevent some types of flood attacks.		# to help prevent some types of flood attacks.
			# Allowing ICMP is mandatory for Path MTU Discovery
	ip protocol icmp limit rate 4/second accept		ip protocol icmp limit rate 4/second accept
	# Allowing ICMPv6 is mandatory for IPv6 to work		# Allowing ICMPv6 is mandatory for IPv6 to work

Pablo: add comment regarding ICMPv6 (per Thomas Landauer)

2021-07-27T22:56:57Z

add comment regarding ICMPv6 (per Thomas Landauer)

← Older revision		Revision as of 22:56, 27 July 2021
Line 38:		Line 38:
	# to help prevent some types of flood attacks.		# to help prevent some types of flood attacks.
	ip protocol icmp limit rate 4/second accept		ip protocol icmp limit rate 4/second accept
			# Allowing ICMPv6 is mandatory for IPv6 to work
	ip6 nexthdr ipv6-icmp limit rate 4/second accept		ip6 nexthdr ipv6-icmp limit rate 4/second accept
	ip protocol igmp limit rate 4/second accept		ip protocol igmp limit rate 4/second accept

Glloyd: Create page

2020-06-16T18:03:56Z

Create page

New page

Here's a very basic example of the nftables.conf file you might use on a web server. In this example, we have the option to block off all incoming traffic from the server except from "safe" IP ranges. This is handy if your server is behind CloudFlare, Sucuri, or other similar traffic filtering services.

'''Note:''' Initially, this conf allows all inbound traffic until you comment/uncomment the "From approved IP ranges only" section.

= nftables.conf =

<source lang="bash">
#!/usr/sbin/nft -f

flush ruleset

# List all IPs and IP ranges of your traffic filtering proxy source.
define SAFE_TRAFFIC_IPS = {
x.x.x.x/xx,
x.x.x.x/xx,
x.x.x.x,
x.x.x.x
}

table inet firewall {

chain inbound {

# By default, drop all traffic unless it meets a filter
# criteria specified by the rules that follow below.
type filter hook input priority 0; policy drop;

# Allow traffic from established and related packets.
ct state established,related accept

# Drop invalid packets.
ct state invalid drop

# Allow loopback traffic.
iifname lo accept

# Allow all ICMP and IGMP traffic, but enforce a rate limit
# to help prevent some types of flood attacks.
ip protocol icmp limit rate 4/second accept
ip6 nexthdr ipv6-icmp limit rate 4/second accept
ip protocol igmp limit rate 4/second accept

# Allow SSH on port 22.
tcp dport 22 accept

# Allow HTTP(S).
# -- From anywhere
tcp dport { http, https } accept
udp dport { http, https } accept
# -- From approved IP ranges only
# tcp dport { http, https } ip saddr $SAFE_TRAFFIC_IPS accept
# udp dport { http, https } ip saddr $SAFE_TRAFFIC_IPS accept

# Uncomment to allow incoming traffic on other ports.
# -- Allow Jekyll dev traffic on port 4000.
# tcp dport 4000 accept
# -- Allow Hugo dev traffic on port 1313.
# tcp dport 1313 accept

# Uncomment to enable logging of denied inbound traffic
# log prefix "[nftables] Inbound Denied: " flags all counter drop

}

chain forward {

# Drop everything (assumes this device is not a router)
type filter hook forward priority 0; policy drop;

# Uncomment to enable logging of denied forwards
# log prefix "[nftables] Forward Denied: " flags all counter drop

}

chain outbound {

# Allow all outbound traffic
type filter hook output priority 0; policy accept;

}

}
</source>