25 lines
428 B
Text
25 lines
428 B
Text
table inet filter {
|
|
|
|
set asn_deny_v4 {
|
|
type ipv4_addr
|
|
flags interval, timeout
|
|
timeout 7d
|
|
auto-merge
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority 0;
|
|
policy drop;
|
|
|
|
ct state established,related accept
|
|
iif lo accept
|
|
|
|
# Public: only HTTP/HTTPS
|
|
tcp dport {80,443} accept
|
|
|
|
# ASN TTL drop (optional)
|
|
ip saddr @asn_deny_v4 drop
|
|
|
|
reject with icmpx type port-unreachable
|
|
}
|
|
}
|