Created
April 22, 2016 07:45
-
-
Save dseg/3e0c4842b0c868e79c527f9f566de636 to your computer and use it in GitHub Desktop.
A basic nftables config. Only accept ssh, http and https.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/nft -f | |
| # ipv4/ipv6 Simple & Safe Firewall | |
| # you can find examples in /usr/share/nftables/ | |
| table inet filter { | |
| chain input { | |
| type filter hook input priority 0; | |
| # allow established/related connections | |
| ct state {established, related} accept | |
| # early drop of invalid connections | |
| ct state invalid drop | |
| # allow from loopback | |
| iifname lo accept | |
| # allow icmp | |
| ip protocol icmp accept | |
| ip6 nexthdr icmpv6 accept | |
| # allow ssh,http | |
| tcp dport {ssh,http,https} accept | |
| # allow n2o | |
| tcp dport 8001 accept | |
| # everything else | |
| reject with icmp type port-unreachable | |
| } | |
| chain forward { | |
| type filter hook forward priority 0; | |
| drop | |
| } | |
| chain output { | |
| type filter hook output priority 0; | |
| } | |
| } | |
| # vim:set ts=2 sw=2 et: |
I can't access the router
You don't have to. This is an application level firewall config.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I can't access the router