Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2024-12-22 21:49:22 -05:00
Code Issues Packages Projects Releases Wiki Activity

nftables: implement output filtering for loopback

Browse Source
This commit is contained in:
Daniel Micay 2022-06-30 06:41:52 -04:00
parent fea9197ace
commit 01f9274fc4
6 changed files with 3 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nftables-attestation.conf
View File

@ -45,8 +45,6 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo accept
skuid != {root, systemd-network, chrony, unbound, http, attestation} counter goto output-reject skuid != {root, systemd-network, chrony, unbound, http, attestation} counter goto output-reject
} }

2
nftables-discuss.conf
View File

@ -45,8 +45,6 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo accept
skuid != {root, systemd-network, chrony, unbound, http, flarum} counter goto output-reject skuid != {root, systemd-network, chrony, unbound, http, flarum} counter goto output-reject
} }

2
nftables-dns.conf
View File

@ -48,8 +48,6 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo accept
skuid != {root, systemd-network, chrony, unbound, powerdns} counter goto output-reject skuid != {root, systemd-network, chrony, unbound, powerdns} counter goto output-reject
} }

3
nftables-mail.conf
View File

@ -45,8 +45,7 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo accept skuid {opendmarc, opendkim, policyd-spf} oif lo meta l4proto {tcp, udp} th dport 53 accept
skuid != {root, systemd-network, chrony, unbound, postfix, dovecot, dovenull} counter goto output-reject skuid != {root, systemd-network, chrony, unbound, postfix, dovecot, dovenull} counter goto output-reject
} }

4
nftables-matrix.conf
View File

@ -45,8 +45,8 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo accept skuid postgres oif lo meta l4proto udp accept
skuid mjolnir oif lo tcp dport 8008 accept
skuid != {root, systemd-network, chrony, unbound, http, synapse, matterbridge} counter goto output-reject skuid != {root, systemd-network, chrony, unbound, http, synapse, matterbridge} counter goto output-reject
} }

2
nftables-web.conf
View File

@ -45,8 +45,6 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo accept
skuid != {root, systemd-network, chrony, unbound, http} counter goto output-reject skuid != {root, systemd-network, chrony, unbound, http} counter goto output-reject
} }