From 14e9cd5b760810ca8524f487810e96f3cc5093f1 Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Sun, 24 Mar 2024 16:23:54 -0400 Subject: [PATCH] use standard style for nftables sets --- nftables-attestation.conf | 18 +++++++++--------- nftables-discuss.conf | 20 ++++++++++---------- nftables-mail.conf | 18 +++++++++--------- nftables-matrix.conf | 18 +++++++++--------- nftables-network.conf | 18 +++++++++--------- nftables-ns1.conf | 20 ++++++++++---------- nftables-ns2.conf | 20 ++++++++++---------- nftables-social.conf | 18 +++++++++--------- nftables-web.conf | 18 +++++++++--------- 9 files changed, 84 insertions(+), 84 deletions(-) diff --git a/nftables-attestation.conf b/nftables-attestation.conf index 4299ff6..c13c9da 100644 --- a/nftables-attestation.conf +++ b/nftables-attestation.conf @@ -14,16 +14,16 @@ table inet filter { # drop packets to address not configured on incoming interface (strong host model) fib daddr . iif type != { local, broadcast, multicast } counter drop - tcp dport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp dport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { type filter hook output priority raw oif lo notrack accept - tcp sport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp sport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -31,8 +31,8 @@ table inet filter { policy drop iif lo accept - tcp dport {22, 80, 443} accept - meta l4proto {icmp, ipv6-icmp} accept + tcp dport { 22, 80, 443 } accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -50,12 +50,12 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, http, attestation} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, http, attestation } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 th dport != 8080 accept - skuid {chrony, attestation} meta l4proto {tcp, udp} th sport >= 1024 th sport != 8080 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 th dport != 8080 accept + skuid { chrony, attestation } meta l4proto { tcp, udp } th sport >= 1024 th sport != 8080 th dport 53 accept skuid attestation tcp sport 8080 tcp dport >= 1024 tcp dport != 8080 accept skuid http tcp sport >= 1024 tcp sport != 8080 tcp dport 8080 accept diff --git a/nftables-discuss.conf b/nftables-discuss.conf index ec612d8..448f51b 100644 --- a/nftables-discuss.conf +++ b/nftables-discuss.conf @@ -15,18 +15,18 @@ table inet filter { fib daddr . iif type != { local, broadcast, multicast } counter drop # IPv6 interacts badly with IP-based spam filtering - meta nfproto ipv6 tcp dport {80, 443} reject with tcp reset + meta nfproto ipv6 tcp dport { 80, 443 } reject with tcp reset - tcp dport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp dport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { type filter hook output priority raw oif lo notrack accept - tcp sport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp sport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -34,8 +34,8 @@ table inet filter { policy drop iif lo accept - tcp dport {22, 80, 443} accept - meta l4proto {icmp, ipv6-icmp} accept + tcp dport { 22, 80, 443 } accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -53,12 +53,12 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, http, flarum, flarum-admin, geoipupdate} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, http, flarum, flarum-admin, geoipupdate } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 accept - skuid {chrony, http, flarum, flarum-admin, geoipupdate} meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept + skuid { chrony, http, flarum, flarum-admin, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid != root counter goto output-reject accept diff --git a/nftables-mail.conf b/nftables-mail.conf index d42bcc9..c5836bf 100644 --- a/nftables-mail.conf +++ b/nftables-mail.conf @@ -14,16 +14,16 @@ table inet filter { # drop packets to address not configured on incoming interface (strong host model) fib daddr . iif type != { local, broadcast, multicast } counter drop - tcp dport {22, 25, 80, 443, 465, 993} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp dport { 22, 25, 80, 443, 465, 993 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { type filter hook output priority raw oif lo notrack accept - tcp sport {22, 25, 80, 443, 465, 993} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp sport { 22, 25, 80, 443, 465, 993 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -31,8 +31,8 @@ table inet filter { policy drop iif lo accept - tcp dport {22, 25, 80, 443, 465, 993} accept - meta l4proto {icmp, ipv6-icmp} accept + tcp dport { 22, 25, 80, 443, 465, 993 } accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -50,12 +50,12 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, postfix, dovecot, dovenull, http} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, postfix, dovecot, dovenull, http } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 accept - skuid {chrony, postfix, opendkim, opendmarc, policyd-spf} meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept + skuid { chrony, postfix, opendkim, opendmarc, policyd-spf } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid != root counter goto output-reject accept diff --git a/nftables-matrix.conf b/nftables-matrix.conf index d904776..1ce34e6 100644 --- a/nftables-matrix.conf +++ b/nftables-matrix.conf @@ -14,16 +14,16 @@ table inet filter { # drop packets to address not configured on incoming interface (strong host model) fib daddr . iif type != { local, broadcast, multicast } counter drop - tcp dport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp dport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { type filter hook output priority raw oif lo notrack accept - tcp sport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp sport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -31,8 +31,8 @@ table inet filter { policy drop iif lo accept - tcp dport {22, 80, 443} accept - meta l4proto {icmp, ipv6-icmp} accept + tcp dport { 22, 80, 443 } accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -50,12 +50,12 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, http, synapse, matterbridge} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, http, synapse, matterbridge } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 th dport != 8008 accept - skuid {chrony, synapse, matterbridge} meta l4proto {tcp, udp} th sport >= 1024 th sport != 8008 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 th dport != 8008 accept + skuid { chrony, synapse, matterbridge } meta l4proto { tcp, udp } th sport >= 1024 th sport != 8008 th dport 53 accept skuid postgres udp sport >= 1024 udp sport != 8008 udp dport >= 1024 udp dport != 8008 accept diff --git a/nftables-network.conf b/nftables-network.conf index b940897..552c35e 100644 --- a/nftables-network.conf +++ b/nftables-network.conf @@ -14,18 +14,18 @@ table inet filter { # drop packets to address not configured on incoming interface (strong host model) fib daddr . iif type != { local, broadcast, multicast } counter drop - tcp dport {22, 80, 443, 7275} notrack accept + tcp dport { 22, 80, 443, 7275 } notrack accept udp dport 123 notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { type filter hook output priority raw oif lo notrack accept - tcp sport {22, 80, 443, 7275} notrack accept + tcp sport { 22, 80, 443, 7275 } notrack accept udp sport 123 notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -33,9 +33,9 @@ table inet filter { policy drop iif lo accept - tcp dport {22, 80, 443, 7275} accept + tcp dport { 22, 80, 443, 7275 } accept udp dport 123 accept - meta l4proto {icmp, ipv6-icmp} accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -53,12 +53,12 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, http} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, http } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 accept - skuid {chrony, http} meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept + skuid { chrony, http } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid != root counter goto output-reject accept diff --git a/nftables-ns1.conf b/nftables-ns1.conf index 85be323..1143f6d 100644 --- a/nftables-ns1.conf +++ b/nftables-ns1.conf @@ -15,8 +15,8 @@ table inet filter { fib daddr . iif type != { local, broadcast, multicast } counter drop udp dport 53 notrack accept - tcp dport {22, 53, 80, 443, 853} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp dport { 22, 53, 80, 443, 853 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { @@ -24,8 +24,8 @@ table inet filter { oif lo notrack accept udp sport 53 notrack accept - tcp sport {22, 53, 80, 443, 853} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp sport { 22, 53, 80, 443, 853 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -34,8 +34,8 @@ table inet filter { iif lo accept udp dport 53 accept - tcp dport {22, 53, 80, 443, 853} accept - meta l4proto {icmp, ipv6-icmp} accept + tcp dport { 22, 53, 80, 443, 853 } accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -53,15 +53,15 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, http, powerdns, geoipupdate} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, http, powerdns, geoipupdate } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 accept - skuid {chrony, geoipupdate} meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept + skuid { chrony, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid powerdns meta l4proto tcp th sport 54 th dport >= 1024 accept - skuid http meta l4proto {tcp, udp} th sport >= 1024 th dport 54 accept + skuid http meta l4proto { tcp, udp } th sport >= 1024 th dport 54 accept skuid powerdns meta l4proto tcp th sport 81 th dport >= 1024 accept diff --git a/nftables-ns2.conf b/nftables-ns2.conf index 3178e19..8ce6874 100644 --- a/nftables-ns2.conf +++ b/nftables-ns2.conf @@ -18,8 +18,8 @@ table inet filter { tcp dport 22 ip daddr 198.251.90.93 reject with tcp reset udp dport 53 notrack accept - tcp dport {22, 53, 80, 443, 853} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp dport { 22, 53, 80, 443, 853 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { @@ -27,8 +27,8 @@ table inet filter { oif lo notrack accept udp sport 53 notrack accept - tcp sport {22, 53, 80, 443, 853} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp sport { 22, 53, 80, 443, 853 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -37,8 +37,8 @@ table inet filter { iif lo accept udp dport 53 accept - tcp dport {22, 53, 80, 443, 853} accept - meta l4proto {icmp, ipv6-icmp} accept + tcp dport { 22, 53, 80, 443, 853 } accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -56,15 +56,15 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, http, powerdns, geoipupdate} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, http, powerdns, geoipupdate } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 accept - skuid {chrony, geoipupdate} meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept + skuid { chrony, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid powerdns meta l4proto tcp th sport 54 th dport >= 1024 accept - skuid http meta l4proto {tcp, udp} th sport >= 1024 th dport 54 accept + skuid http meta l4proto { tcp, udp } th sport >= 1024 th dport 54 accept skuid powerdns meta l4proto tcp th sport 81 th dport >= 1024 accept diff --git a/nftables-social.conf b/nftables-social.conf index 7d5e86a..54052c0 100644 --- a/nftables-social.conf +++ b/nftables-social.conf @@ -14,16 +14,16 @@ table inet filter { # drop packets to address not configured on incoming interface (strong host model) fib daddr . iif type != { local, broadcast, multicast } counter drop - tcp dport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp dport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { type filter hook output priority raw oif lo notrack accept - tcp sport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp sport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -31,8 +31,8 @@ table inet filter { policy drop iif lo accept - tcp dport {22, 80, 443} accept - meta l4proto {icmp, ipv6-icmp} accept + tcp dport { 22, 80, 443 } accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -50,12 +50,12 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, http, mastodon} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, http, mastodon } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 accept - skuid {chrony, mastodon} meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept + skuid { chrony, mastodon } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid postgres udp sport >= 1024 udp dport >= 1024 accept diff --git a/nftables-web.conf b/nftables-web.conf index 40338cf..6ed10bb 100644 --- a/nftables-web.conf +++ b/nftables-web.conf @@ -14,16 +14,16 @@ table inet filter { # drop packets to address not configured on incoming interface (strong host model) fib daddr . iif type != { local, broadcast, multicast } counter drop - tcp dport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp dport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain output-raw { type filter hook output priority raw oif lo notrack accept - tcp sport {22, 80, 443} notrack accept - meta l4proto {icmp, ipv6-icmp} notrack accept + tcp sport { 22, 80, 443 } notrack accept + meta l4proto { icmp, ipv6-icmp } notrack accept } chain input { @@ -31,8 +31,8 @@ table inet filter { policy drop iif lo accept - tcp dport {22, 80, 443} accept - meta l4proto {icmp, ipv6-icmp} accept + tcp dport { 22, 80, 443 } accept + meta l4proto { icmp, ipv6-icmp } accept ct state vmap { invalid : drop, established : accept, related : accept } @@ -50,12 +50,12 @@ table inet filter { type filter hook output priority filter oif lo goto output-internal - skuid != {root, systemd-network, unbound, chrony, http} counter goto output-reject + skuid != { root, systemd-network, unbound, chrony, http } counter goto output-reject } chain output-internal { - skuid unbound meta l4proto {tcp, udp} th sport 53 th dport >= 1024 accept - skuid chrony meta l4proto {tcp, udp} th sport >= 1024 th dport 53 accept + skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept + skuid chrony meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid != root counter goto output-reject accept