evolix/minifirewall
21
0
Fork 0
Code Issues 4 Pull requests 3 Releases 1 Activity

Update/Add section titles

Browse source
This commit is contained in:
Tristan PILAT 2020-11-18 17:45:52 +01:00
parent 6bc1b75cd2
commit 7a1adbdf39
1 changed files with 10 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
minifirewall-start.sh
View file

@ -64,14 +64,16 @@ for i in /proc/sys/net/ipv4/conf/*/log_martians; do
echo 1 > $i echo 1 > $i
done done
# IPTables configuration #########################
######################## ## NFTables configuration
#########################
if ! test -f $configfile; then if ! test -f $configfile; then
echo "$configfile does not exist" >&2 echo "$configfile does not exist" >&2
exit 1 exit 1
fi fi
# Parse configuration file
. $configfile . $configfile
# Flush everything first # Flush everything first
@ -105,6 +107,9 @@ $NFT add chain inet minifirewall semipublic_udp_ports
$NFT add chain inet minifirewall private_tcp_ports $NFT add chain inet minifirewall private_tcp_ports
$NFT add chain inet minifirewall private_udp_ports $NFT add chain inet minifirewall private_udp_ports
################
## Input traffic
################
# Related and established traffic is accepted # Related and established traffic is accepted
$NFT add rule inet minifirewall minifirewall_input ct state related,established accept $NFT add rule inet minifirewall minifirewall_input ct state related,established accept
@ -198,9 +203,9 @@ for x in $SERVICESUDP1p
$NFT add rule inet minifirewall protected_udp_ports udp dport $x drop $NFT add rule inet minifirewall protected_udp_ports udp dport $x drop
done done
# #####################################
## External services ## Output traffic / external services
#################### #####################################
# Add set with $DNSSERVERS elements # Add set with $DNSSERVERS elements
$NFT add set inet minifirewall minifirewall_dnsservers { type ipv4_addr\;} $NFT add set inet minifirewall minifirewall_dnsservers { type ipv4_addr\;}