Allow SSH input by default.
This commit is contained in:
parent
84fd89f6e6
commit
19acb4cb22
|
@ -71,6 +71,8 @@ nft_input_default_rules:
|
||||||
- jump global
|
- jump global
|
||||||
010 drop unwanted:
|
010 drop unwanted:
|
||||||
- ip daddr @blackhole counter drop
|
- ip daddr @blackhole counter drop
|
||||||
|
022 ssh:
|
||||||
|
- tcp dport ssh ct state new counter accept
|
||||||
nft_input_group_rules: {}
|
nft_input_group_rules: {}
|
||||||
nft_input_host_rules: {}
|
nft_input_host_rules: {}
|
||||||
|
|
||||||
|
@ -133,6 +135,7 @@ table inet firewall {
|
||||||
type filter hook input priority 0; policy drop;
|
type filter hook input priority 0; policy drop;
|
||||||
jump global
|
jump global
|
||||||
ip daddr @blackhole counter packets 3 bytes 204 drop
|
ip daddr @blackhole counter packets 3 bytes 204 drop
|
||||||
|
tcp dport ssh ct state new counter packets 0 bytes 0 accept
|
||||||
}
|
}
|
||||||
|
|
||||||
chain output {
|
chain output {
|
||||||
|
|
|
@ -22,6 +22,7 @@ nft_global_default_rules:
|
||||||
- ct state invalid drop
|
- ct state invalid drop
|
||||||
nft_global_group_rules: {}
|
nft_global_group_rules: {}
|
||||||
nft_global_host_rules: {}
|
nft_global_host_rules: {}
|
||||||
|
|
||||||
nft_input_default_rules:
|
nft_input_default_rules:
|
||||||
000 policy:
|
000 policy:
|
||||||
- type filter hook input priority 0; policy drop;
|
- type filter hook input priority 0; policy drop;
|
||||||
|
@ -29,6 +30,8 @@ nft_input_default_rules:
|
||||||
- jump global
|
- jump global
|
||||||
010 drop unwanted:
|
010 drop unwanted:
|
||||||
- ip daddr @blackhole counter drop
|
- ip daddr @blackhole counter drop
|
||||||
|
022 ssh:
|
||||||
|
- tcp dport ssh ct state new counter accept
|
||||||
nft_input_group_rules: {}
|
nft_input_group_rules: {}
|
||||||
nft_input_host_rules: {}
|
nft_input_host_rules: {}
|
||||||
|
|
||||||
|
@ -40,6 +43,7 @@ nft_define_default:
|
||||||
value: '{ 255.255.255.255, 224.0.0.1, 224.0.0.251 }'
|
value: '{ 255.255.255.255, 224.0.0.1, 224.0.0.251 }'
|
||||||
nft_define_group: {}
|
nft_define_group: {}
|
||||||
nft_define_host: {}
|
nft_define_host: {}
|
||||||
|
|
||||||
nft_set_default:
|
nft_set_default:
|
||||||
blackhole:
|
blackhole:
|
||||||
- type ipv4_addr;
|
- type ipv4_addr;
|
||||||
|
|
Loading…
Reference in New Issue