Initial commit

2025-10-01 12:59:38 +03:00
commit 24f9220e2c
6 changed files with 118 additions and 0 deletions
@@ -0,0 +1,26 @@
+#!/usr/bin/nft -f
+# vim:set ts=2 sw=2 et:
+
+# IPv4/IPv6 Simple & Safe firewall ruleset.
+# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.
+
+destroy table inet filter
+table inet filter {
+  chain input {
+    type filter hook input priority filter
+    policy drop
+
+    ct state invalid drop comment "early drop of invalid connections"
+    ct state {established, related} accept comment "allow tracked connections"
+    iif lo accept comment "allow from loopback"
+    ip protocol icmp accept comment "allow icmp"
+    meta l4proto ipv6-icmp accept comment "allow icmp v6"
+    tcp dport ssh accept comment "allow sshd"
+    pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
+    counter
+  }
+  chain forward {
+    type filter hook forward priority filter
+    policy drop
+  }
+}
@@ -0,0 +1,6 @@
+name: nftables
+description: Nftables daemon
+type: simple
+start_cmd: /usr/bin/nft -f /etc/nftables.conf
+stop_cmd: /usr/bin/nft flush ruleset
+exit_method: stop_command