evolix
/
minifirewall
18
0
Fork 0
Code Issues 4 Pull Requests 3 Releases 1 Activity

Add rules to redirsct traffic from blocked IPs to protected_tcp_pots and protected_udp_ports chains

This commit is contained in:
Tristan PILAT 2020-10-14 17:16:17 +02:00
parent 6a46ca716b
commit 1c1d5480bc
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
minifirewall-start.sh
View File

@ -121,6 +121,11 @@ $NFT add rule inet minifirewall minifirewall_input ct state invalid drop
$NFT add rule inet minifirewall minifirewall_input ip protocol icmp accept
$NFT add rule inet minifirewall minifirewall_input ip protocol igmp accept
# New UDP traffic from blocked IPs jumps to the private_udp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_blocked_ips meta l4proto udp ct state new jump protected_udp_ports'
# New TCP traffic from blocked IPs jumps to the private_tcp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_blocked_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump protected_tcp_ports'
# New UDP traffic from trusted IPs jumps to the private_udp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_trusted_ips meta l4proto udp ct state new jump private_udp_ports'