Remove DHCP incoming packets. The connection is started by the host, don't need incoming rule.

CHANGELOG.md

@@ -8,6 +8,7 @@
 ### Default Rules
 * Use more sets and vars definitions to avoid multiple rules.
 * Allow outgoing icmp.
+* Remove DHCP incoming packets. The connection is started by the host, don't need incoming rule.
 
 ## v1.0
 

README.md

@@ -79,8 +79,6 @@ nft_input_default_rules:
     - ip daddr @blackhole counter drop
   015 localhost:
     - iif lo accept
-  040 dhcp:
-    - udp sport bootps udp dport bootpc limit rate 6/minute accept
   220 ssh:
     - tcp dport ssh ct state new counter accept
 nft_input_group_rules: {}

defaults/main.yml

@@ -34,8 +34,6 @@ nft_input_default_rules:
     - ip daddr @blackhole counter drop
   015 localhost:
     - iif lo accept
-  040 dhcp:
-    - udp sport bootps udp dport bootpc limit rate 6/minute accept
   220 ssh:
     - tcp dport ssh ct state new counter accept
 nft_input_group_rules: {}