55 lines
1.4 KiB
Plaintext
55 lines
1.4 KiB
Plaintext
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
iifname "lo" accept
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
|
|
iifname "eth0" ip saddr 10.0.0.0/8 drop
|
|
iifname "eth0" ip saddr 172.16.0.0/12 drop
|
|
iifname "eth0" ip saddr 192.168.0.0/16 drop
|
|
|
|
tcp dport 22 ct state new limit rate 3/minute burst 5 packets accept
|
|
tcp dport { 80, 443 } accept
|
|
tcp dport 8080 accept
|
|
udp dport 53 accept
|
|
tcp dport 53 accept
|
|
udp dport 123 accept
|
|
|
|
icmp type echo-request limit rate 1/second burst 5 packets accept
|
|
icmp type { echo-reply, destination-unreachable, time-exceeded } accept
|
|
|
|
ip saddr 203.0.113.0/24 tcp dport 3306 accept
|
|
ip saddr 198.51.100.10 tcp dport 5432 accept
|
|
|
|
limit rate 5/minute log prefix "DROPPED: "
|
|
drop
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
|
|
ct state established,related accept
|
|
drop
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority 0; policy accept;
|
|
}
|
|
}
|
|
|
|
table inet nat {
|
|
chain postrouting {
|
|
type nat hook postrouting priority 100;
|
|
|
|
oifname "eth0" masquerade
|
|
}
|
|
|
|
chain prerouting {
|
|
type nat hook prerouting priority -100;
|
|
|
|
iifname "eth0" tcp dport 8443 dnat to 10.0.1.5:443
|
|
}
|
|
}
|