105 lines
2.8 KiB
YAML
105 lines
2.8 KiB
YAML
---
|
|
# defaults file for nftables
|
|
|
|
# packages
|
|
nft_pkg_manage: true
|
|
nft_pkg_state: 'installed'
|
|
|
|
# files
|
|
nft_conf_dir_path: '/etc/nftables.d'
|
|
nft_main_conf_path: '/etc/nftables.conf'
|
|
nft_main_conf_content: 'etc/nftables.conf.j2'
|
|
nft_input_conf_path: '{{ nft_conf_dir_path }}/filter-input.nft'
|
|
nft_input_conf_content: 'etc/nftables.d/filter-input.nft.j2'
|
|
nft_output_conf_path: '{{ nft_conf_dir_path }}/filter-output.nft'
|
|
nft_output_conf_content: 'etc/nftables.d/filter-output.nft.j2'
|
|
nft_define_conf_path: '{{ nft_conf_dir_path }}/defines.nft'
|
|
nft_define_conf_content: 'etc/nftables.d/defines.nft.j2'
|
|
nft_set_conf_path: '{{ nft_conf_dir_path }}/sets.nft'
|
|
nft_set_conf_content: 'etc/nftables.d/sets.nft.j2'
|
|
|
|
# rules
|
|
nft_global_default_rules:
|
|
005 state management:
|
|
- ct state established,related accept
|
|
- ct state invalid drop
|
|
nft_global_group_rules: {}
|
|
nft_global_host_rules: {}
|
|
|
|
nft_input_default_rules:
|
|
000 policy:
|
|
- type filter hook input priority 0; policy drop;
|
|
005 global:
|
|
- jump global
|
|
010 drop unwanted:
|
|
- ip daddr @blackhole counter drop
|
|
015 localhost:
|
|
- iif lo accept
|
|
200 input udp accepted:
|
|
- udp dport @input_udp_accept ct state new accept
|
|
210 input tcp accepted:
|
|
- tcp dport @input_tcp_accept ct state new accept
|
|
nft_input_group_rules: {}
|
|
nft_input_host_rules: {}
|
|
|
|
nft_output_default_rules:
|
|
000 policy:
|
|
- type filter hook output priority 0; policy drop;
|
|
005 global:
|
|
- jump global
|
|
015 localhost:
|
|
- oif lo accept
|
|
050 icmp:
|
|
- ip protocol icmp accept
|
|
200 output udp accepted:
|
|
- udp dport @output_udp_accept ct state new accept
|
|
210 output tcp accepted:
|
|
- tcp dport @output_tcp_accept ct state new accept
|
|
nft_output_group_rules: {}
|
|
nft_output_host_rules: {}
|
|
|
|
# define nft vars
|
|
nft_define_default:
|
|
broadcast and multicast:
|
|
desc: 'broadcast and multicast'
|
|
name: badcast_addr
|
|
value: '{ 255.255.255.255, 224.0.0.1, 224.0.0.251 }'
|
|
input tcp accepted:
|
|
name: input_tcp_accept
|
|
value: '{ ssh }'
|
|
input udp accepted:
|
|
name: input_udp_accept
|
|
value: 'none'
|
|
output tcp accepted:
|
|
name: output_tcp_accept
|
|
value: '{ http, https, hkp }'
|
|
output udp accepted:
|
|
name: output_udp_accept
|
|
value: '{ bootps, domain, ntp }'
|
|
nft_define_group: {}
|
|
nft_define_host: {}
|
|
|
|
# sets and maps
|
|
nft_set_default:
|
|
blackhole:
|
|
- type ipv4_addr;
|
|
- elements = $badcast_addr
|
|
input_tcp_accept:
|
|
- type inet_service; flags interval;
|
|
- elements = $input_tcp_accept
|
|
input_udp_accept:
|
|
- type inet_service; flags interval;
|
|
output_tcp_accept:
|
|
- type inet_service; flags interval;
|
|
- elements = $output_tcp_accept
|
|
output_udp_accept:
|
|
- type inet_service; flags interval;
|
|
- elements = $output_udp_accept
|
|
nft_set_group: {}
|
|
nft_set_host: {}
|
|
|
|
# service
|
|
nft_service_manage: true
|
|
nft_service_name: 'nftables'
|
|
nft_service_enabled: true
|