evolix
/
minifirewall
21
0
Fork 0
Code Issues 4 Pull Requests 3 Releases 1 Activity

Add IPv6 compatibility

This commit is contained in:
Tristan PILAT 2020-11-18 17:56:11 +01:00
parent ab2a7e9eb0
commit ba865faf0a
1 changed files with 24 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
minifirewall-start.sh
View File

@ -109,20 +109,34 @@ $NFT add chain inet minifirewall minifirewall_output '{ type filter hook output
# Add set with trusted IP addresses
$NFT add set inet minifirewall minifirewall_trusted_v4_ips '{ type ipv4_addr ; flags interval ;}'
$NFT add set inet minifirewall minifirewall_trusted_v6_ips '{ type ipv6_addr ; flags interval ;}'
ip_type "$TRUSTEDIPS"
if [ -n "$v4_ips" ] ; then
$NFT add element inet minifirewall minifirewall_trusted_v4_ips {$v4_ips}
fi
if [ -n "$v6_ips" ] ; then
$NFT add element inet minifirewall minifirewall_trusted_v6_ips {$v6_ips}
fi
# Add set with privileged IP addresses
$NFT add set inet minifirewall minifirewall_privileged_v4_ips '{ type ipv4_addr ; flags interval ;}'
$NFT add set inet minifirewall minifirewall_privileged_v6_ips '{ type ipv6_addr ; flags interval ;}'
ip_type "$PRIVILEGIEDIPS"
if [ -n "$v4_ips" ] ; then
$NFT add element inet minifirewall minifirewall_privileged_v4_ips {$v4_ips}
fi
if [ -n "$v6_ips" ] ; then
$NFT add element inet minifirewall minifirewall_privileged_v6_ips {$v6_ips}
fi
# Add set for blocked IP addresses
$NFT add set inet minifirewall minifirewall_blocked_v4_ips '{ type ipv4_addr ; flags interval ;}'
$NFT add set inet minifirewall minifirewall_blocked_v6_ips '{ type ipv6_addr ; flags interval ;}'
# Add TCP/UDP chains for protected, public, semi-public and private ports
$NFT add chain inet minifirewall protected_tcp_ports
$NFT add chain inet minifirewall protected_udp_ports
@ -136,6 +150,7 @@ $NFT add chain inet minifirewall private_udp_ports
################
## Input traffic
################
# Related and established traffic is accepted
$NFT add rule inet minifirewall minifirewall_input ct state related,established accept
@ -154,22 +169,31 @@ $NFT add rule inet minifirewall minifirewall_input ip protocol igmp accept
# New UDP traffic from blocked IPs jumps to the private_udp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_blocked_v4_ips meta l4proto udp ct state new jump protected_udp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip6 saddr @minifirewall_blocked_v6_ips meta l4proto udp ct state new jump protected_udp_ports'
# New TCP traffic from blocked IPs jumps to the private_tcp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_blocked_v4_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump protected_tcp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip6 saddr @minifirewall_blocked_v6_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump protected_tcp_ports'
# New UDP traffic from trusted IPs jumps to the private_udp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_trusted_v4_ips meta l4proto udp ct state new jump private_udp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip6 saddr @minifirewall_trusted_v6_ips meta l4proto udp ct state new jump private_udp_ports'
# New TCP traffic from trusted IPs jumps to the private_tcp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_trusted_v4_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump private_tcp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip6 saddr @minifirewall_trusted_v6_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump private_tcp_ports'
# New UDP traffic from trusted IPs and privileged IPs jumps to the semipublic_udp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_privileged_v4_ips meta l4proto udp ct state new jump semipublic_udp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip6 saddr @minifirewall_privileged_v6_ips meta l4proto udp ct state new jump semipublic_udp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_trusted_v4_ips meta l4proto udp ct state new jump semipublic_udp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip6 saddr @minifirewall_trusted_v6_ips meta l4proto udp ct state new jump semipublic_udp_ports'
# New TCP traffic from trusted IPs and privileged IPs jumps to the semipublic_tcp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_privileged_v4_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump semipublic_tcp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip6 saddr @minifirewall_privileged_v6_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump semipublic_tcp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip saddr @minifirewall_trusted_v4_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump semipublic_tcp_ports'
$NFT add rule inet minifirewall minifirewall_input 'ip6 saddr @minifirewall_trusted_v6_ips meta l4proto tcp tcp flags & (fin|syn|rst|ack) == syn ct state new jump semipublic_tcp_ports'
# New UDP traffic from any other IP jumps to the public_udp_ports chain
$NFT add rule inet minifirewall minifirewall_input 'meta l4proto udp ct state new jump public_udp_ports'