Switch to nft interface by default

source-files/ip6tables.esv

@@ -0,0 +1,6 @@
+name: iptables
+description: IPv6 Packet Filtering Framework
+type: simple
+start_cmd: /etc/esvm/scripts/ip6tables.sh
+stop_cmd: /etc/esvm/scripts/iptables-flush.sh -6
+exit_method: stop_command

source-files/ip6tables.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+[ ! -e /etc/iptables/ip6tables.rules ] && exit 0
+ip6tables-restore -w 3 /etc/iptables/ip6tables.rules || exit 1
+exec ip6tables pause

source-files/iptables-flush.sh

@@ -1,14 +1,21 @@
-# Flush iptables (Code from archlinux)
-iptables=ip$1tables
-if ! type -p "$iptables" &>/dev/null; then
-  echo "error: invalid argument"
-  exit 1
+#!/bin/sh
+# Usage: iptables-flush [-6]
+
+iptables=/usr/sbin/iptables
+tables="filter mangle raw"
+
+if [ "$1" = "-6" ]; then
+  iptables=/usr/bin/ip6tables
+else
+  # Only ipv4 has a nat table
+  tables="$tables nat"
 fi
 
-while read -r table; do
-  tables+=("/usr/share/iptables/empty-$table.rules")
-done <"/proc/net/ip$1_tables_names"
+for table in ${tables}; do
+  $iptables -t "$table" -F
+  $iptables -t "$table" -X
+done
 
-if (( ${#tables[*]} )); then
-  cat "${tables[@]}" | "$iptables-restore"
-fi
+for chain in INPUT FORWARD OUTPUT; do
+  $iptables -P "$chain" ACCEPT
+done

source-files/iptables.esv

@@ -1,6 +1,6 @@
 name: iptables
 description: IPv4 Packet Filtering Framework
 type: simple
-start_cmd: /usr/sbin/iptables-restore /etc/iptables/iptables.rules
+start_cmd: /etc/esvm/scripts/iptables.sh
 stop_cmd: /etc/esvm/scripts/iptables-flush.sh
 exit_method: stop_command

source-files/iptables.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+[ ! -e /etc/iptables/iptables.rules ] && exit 0
+iptables-restore -w 3 /etc/iptables/iptables.rules || exit 1
+exec iptables pause

source-files/rules/simple_firewall.rules

@@ -3,7 +3,7 @@
 :FORWARD DROP [0:0]
 :OUTPUT ACCEPT [0:0]
 -A INPUT -p icmp -j ACCEPT 
--A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT 
+-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
 -A INPUT -i lo -j ACCEPT 
 -A INPUT -p tcp -j REJECT --reject-with tcp-reset 
 -A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable