74 lines
2.2 KiB
Django/Jinja
74 lines
2.2 KiB
Django/Jinja
#!/usr/sbin/nft -f
|
|
# Alliance Boréale - nftables Configuration
|
|
# Generated by Ansible - DO NOT EDIT MANUALLY
|
|
# Host: {{ inventory_hostname }}
|
|
# Date: {{ ansible_date_time.iso8601 }}
|
|
|
|
# Flush all rules
|
|
flush ruleset
|
|
|
|
# Main table for filtering
|
|
table inet filter {
|
|
# Input chain (incoming traffic)
|
|
chain input {
|
|
type filter hook input priority filter; policy {{ firewall.default_policy | default('drop') }};
|
|
|
|
# Allow established/related connections
|
|
ct state established,related accept
|
|
|
|
# Allow loopback
|
|
iif lo accept
|
|
|
|
# Drop invalid packets
|
|
ct state invalid drop
|
|
|
|
# Allow ICMP (ping)
|
|
ip protocol icmp icmp type { echo-request, echo-reply } limit rate 10/second accept
|
|
ip6 nexthdr icmpv6 icmpv6 type { echo-request, echo-reply, nd-neighbor-solicit, nd-neighbor-advert } limit rate 10/second accept
|
|
|
|
# Allow SSH
|
|
tcp dport {{ ssh.port | default(22) }} ct state new limit rate 5/minute accept
|
|
|
|
# Allow DNS (if DNS server)
|
|
{% if 'dns_servers' in group_names %}
|
|
udp dport 53 accept
|
|
tcp dport 53 accept
|
|
{% endif %}
|
|
|
|
# Allow PowerDNS API (internal only)
|
|
{% if 'dns_servers' in group_names %}
|
|
ip saddr {{ network.internal_subnet | default('10.0.0.0/8') }} tcp dport 8081 accept
|
|
{% endif %}
|
|
|
|
# Log dropped packets (rate limited)
|
|
limit rate 5/minute log prefix "[nftables INPUT DROP] " level info
|
|
|
|
# Default: drop
|
|
}
|
|
|
|
# Forward chain (routed traffic)
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop;
|
|
|
|
# Log forwarded packets (if any)
|
|
# log prefix "[nftables FORWARD] " level info
|
|
}
|
|
|
|
# Output chain (outgoing traffic)
|
|
chain output {
|
|
type filter hook output priority filter; policy accept;
|
|
|
|
# Allow all outgoing by default
|
|
}
|
|
}
|
|
|
|
# NAT table (if needed in future)
|
|
# table ip nat {
|
|
# chain prerouting {
|
|
# type nat hook prerouting priority dstnat; policy accept;
|
|
# }
|
|
#
|
|
# chain postrouting {
|
|
# type nat hook postrouting priority srcnat; policy accept;
|
|
# }
|
|
# }
|