cellinfo
/
ansible.nftables
2
0
Fork 0
Code Issues Pull Requests Releases Activity

Allow SSH input by default.

This commit is contained in:
Jeremy Gardais 2017-08-08 14:53:29 +02:00
parent 84fd89f6e6
commit 19acb4cb22
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@ -71,6 +71,8 @@ nft_input_default_rules:
- jump global - jump global
010 drop unwanted: 010 drop unwanted:
- ip daddr @blackhole counter drop - ip daddr @blackhole counter drop
022 ssh:
- tcp dport ssh ct state new counter accept
nft_input_group_rules: {} nft_input_group_rules: {}
nft_input_host_rules: {} nft_input_host_rules: {}
@ -133,6 +135,7 @@ table inet firewall {
type filter hook input priority 0; policy drop; type filter hook input priority 0; policy drop;
jump global jump global
ip daddr @blackhole counter packets 3 bytes 204 drop ip daddr @blackhole counter packets 3 bytes 204 drop
tcp dport ssh ct state new counter packets 0 bytes 0 accept
} }
chain output { chain output {

4
defaults/main.yml
View File

@ -22,6 +22,7 @@ nft_global_default_rules:
- ct state invalid drop - ct state invalid drop
nft_global_group_rules: {} nft_global_group_rules: {}
nft_global_host_rules: {} nft_global_host_rules: {}
nft_input_default_rules: nft_input_default_rules:
000 policy: 000 policy:
- type filter hook input priority 0; policy drop; - type filter hook input priority 0; policy drop;
@ -29,6 +30,8 @@ nft_input_default_rules:
- jump global - jump global
010 drop unwanted: 010 drop unwanted:
- ip daddr @blackhole counter drop - ip daddr @blackhole counter drop
022 ssh:
- tcp dport ssh ct state new counter accept
nft_input_group_rules: {} nft_input_group_rules: {}
nft_input_host_rules: {} nft_input_host_rules: {}
@ -40,6 +43,7 @@ nft_define_default:
value: '{ 255.255.255.255, 224.0.0.1, 224.0.0.251 }' value: '{ 255.255.255.255, 224.0.0.1, 224.0.0.251 }'
nft_define_group: {} nft_define_group: {}
nft_define_host: {} nft_define_host: {}
nft_set_default: nft_set_default:
blackhole: blackhole:
- type ipv4_addr; - type ipv4_addr;