34 lines
1.9 KiB
Text
34 lines
1.9 KiB
Text
|
#!/usr/sbin/nft -f
|
||
|
|
# {{ ansible_managed }}
|
||
|
|
# Relais de {{ serveur_relais_site }} — role serveur_relais. Il ne decide d'aucun service : il fait
|
||
|
|
# suivre les adresses relayees vers {{ serveur_relais_pair_nom }}, qui filtre.
|
||
|
|
flush ruleset
|
||
|
|
|
||
|
|
define CONSOLE = {{ serveur_relais_console }}
|
||
|
|
define RELAYEES = { {{ serveur_relais_adresses_relayees | join(', ') }} }
|
||
|
|
|
||
|
|
table inet relais {
|
||
|
|
chain input {
|
||
|
|
type filter hook input priority filter; policy drop;
|
||
|
|
ct state established,related accept
|
||
|
|
ct state invalid drop
|
||
|
|
iif lo accept
|
||
|
|
udp sport 67 udp dport 68 accept comment "baux DHCP de l'hebergeur"
|
||
|
|
ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded } limit rate 10/second accept
|
||
|
|
ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert, nd-router-advert, destination-unreachable, packet-too-big, time-exceeded } accept
|
||
|
|
ip daddr $CONSOLE tcp dport 22 accept comment "console SSH"
|
||
|
|
ip daddr $CONSOLE udp dport {{ serveur_relais_tunnel_port }} accept comment "tunnel de {{ serveur_relais_pair_nom }}"
|
||
|
|
iifname "{{ serveur_relais_interface_tunnel }}" ip saddr {{ serveur_relais_pair_adresse }} icmp type echo-request accept comment "sonde de {{ serveur_relais_pair_nom }}"
|
||
|
|
counter comment "refus en entree"
|
||
|
|
}
|
||
|
|
chain forward {
|
||
|
|
type filter hook forward priority filter; policy drop;
|
||
|
|
tcp flags syn tcp option maxseg size set rt mtu
|
||
|
|
ct state established,related accept
|
||
|
|
ct state invalid drop
|
||
|
|
iifname "{{ serveur_relais_interface_publique }}" oifname "{{ serveur_relais_interface_tunnel }}" ip daddr $RELAYEES accept comment "Internet vers {{ serveur_relais_pair_nom }}"
|
||
|
|
iifname "{{ serveur_relais_interface_tunnel }}" oifname "{{ serveur_relais_interface_publique }}" ip saddr $RELAYEES accept comment "{{ serveur_relais_pair_nom }} vers Internet, sources relayees seulement"
|
||
|
|
counter comment "refus en transit"
|
||
|
|
}
|
||
|
|
}
|