Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-01-03 11:00:49 -05:00
Code Issues Packages Projects Releases Wiki Activity

enforce IPv6 SUPL connection limit for /64 blocks

Browse Source
This commit is contained in:
Daniel Micay 2024-03-30 20:40:38 -04:00
parent 457f0bf7e8
commit 0fab969de7
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nftables-network.conf
View File

@ -73,7 +73,7 @@ table inet filter {
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
tcp dport 7275 ip saddr @ip-connlimit-supl counter reject with tcp reset tcp dport 7275 ip saddr @ip-connlimit-supl counter reject with tcp reset
tcp dport 7275 ip6 saddr @ip6-connlimit-supl counter reject with tcp reset tcp dport 7275 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-supl counter reject with tcp reset
tcp dport 7275 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 7275 synproxy mss 1460 wscale 7 timestamp sack-perm
} }
@ -81,7 +81,7 @@ table inet filter {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
tcp dport 7275 tcp flags syn add @ip-connlimit-supl { ip saddr ct count over 32 } counter reject with tcp reset tcp dport 7275 tcp flags syn add @ip-connlimit-supl { ip saddr ct count over 32 } counter reject with tcp reset
tcp dport 7275 tcp flags syn add @ip6-connlimit-supl { ip6 saddr ct count over 32 } counter reject with tcp reset tcp dport 7275 tcp flags syn add @ip6-connlimit-supl { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset
accept accept
} }