From 0fab969de7b8050bd78c9740994a4e312f3948b4 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Sat, 30 Mar 2024 20:40:38 -0400 Subject: [PATCH] enforce IPv6 SUPL connection limit for /64 blocks --- nftables-network.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nftables-network.conf b/nftables-network.conf index 4d5ef19..e97a5af 100644 --- a/nftables-network.conf +++ b/nftables-network.conf @@ -73,7 +73,7 @@ table inet filter { tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 7275 ip saddr @ip-connlimit-supl counter reject with tcp reset - tcp dport 7275 ip6 saddr @ip6-connlimit-supl counter reject with tcp reset + tcp dport 7275 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-supl counter reject with tcp reset tcp dport 7275 synproxy mss 1460 wscale 7 timestamp sack-perm } @@ -81,7 +81,7 @@ table inet filter { tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset tcp dport 7275 tcp flags syn add @ip-connlimit-supl { ip saddr ct count over 32 } counter reject with tcp reset - tcp dport 7275 tcp flags syn add @ip6-connlimit-supl { ip6 saddr ct count over 32 } counter reject with tcp reset + tcp dport 7275 tcp flags syn add @ip6-connlimit-supl { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset accept }