Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2024-10-01 00:55:42 -04:00
Code Issues Packages Projects Releases Wiki Activity

rename loopback chains for clarity

Browse Source
This commit is contained in:
Daniel Micay 2024-03-28 14:32:44 -04:00
parent 9b40bb90b8
commit 280eb51c8d
9 changed files with 36 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nftables-attestation.conf
View File

@ -49,7 +49,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
tcp dport { 80, 443 } accept tcp dport { 80, 443 } accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
ct state vmap { established : accept, related : accept, new : goto graceful-reject } ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@ -59,7 +59,7 @@ table inet filter {
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
accept accept
@ -73,11 +73,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, http, attestation } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, http, attestation } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 th dport != 8080 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 th dport != 8080 accept
skuid { chrony, attestation } meta l4proto { tcp, udp } th sport >= 1024 th sport != 8080 th dport 53 accept skuid { chrony, attestation } meta l4proto { tcp, udp } th sport >= 1024 th sport != 8080 th dport 53 accept

8
nftables-discuss.conf
View File

@ -52,7 +52,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
tcp dport { 80, 443 } accept tcp dport { 80, 443 } accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
ct state vmap { established : accept, related : accept, new : goto graceful-reject } ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@ -62,7 +62,7 @@ table inet filter {
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
accept accept
@ -76,11 +76,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, http, flarum, flarum-admin, geoipupdate } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, http, flarum, flarum-admin, geoipupdate } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept
skuid { chrony, http, flarum, flarum-admin, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid { chrony, http, flarum, flarum-admin, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept

8
nftables-mail.conf
View File

@ -49,7 +49,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
tcp dport { 25, 80, 443, 465, 993 } accept tcp dport { 25, 80, 443, 465, 993 } accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
ct state vmap { established : accept, related : accept, new : goto graceful-reject } ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@ -59,7 +59,7 @@ table inet filter {
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
accept accept
@ -73,11 +73,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, postfix, dovecot, dovenull, http } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, postfix, dovecot, dovenull, http } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept
skuid { chrony, postfix, opendkim, opendmarc, policyd-spf } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid { chrony, postfix, opendkim, opendmarc, policyd-spf } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept

8
nftables-matrix.conf
View File

@ -49,7 +49,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
tcp dport { 80, 443 } accept tcp dport { 80, 443 } accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
ct state vmap { established : accept, related : accept, new : goto graceful-reject } ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@ -59,7 +59,7 @@ table inet filter {
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
accept accept
@ -73,11 +73,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, http, synapse, matterbridge } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, http, synapse, matterbridge } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 th dport != 8008 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 th dport != 8008 accept
skuid { chrony, synapse, matterbridge } meta l4proto { tcp, udp } th sport >= 1024 th sport != 8008 th dport 53 accept skuid { chrony, synapse, matterbridge } meta l4proto { tcp, udp } th sport >= 1024 th sport != 8008 th dport 53 accept

8
nftables-network.conf
View File

@ -53,7 +53,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
tcp dport { 80, 443, 7275 } accept tcp dport { 80, 443, 7275 } accept
udp dport 123 accept udp dport 123 accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
@ -64,7 +64,7 @@ table inet filter {
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
accept accept
@ -78,11 +78,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, http } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, http } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept
skuid { chrony, http } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid { chrony, http } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept

8
nftables-ns1.conf
View File

@ -61,7 +61,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
udp dport 53 accept udp dport 53 accept
tcp dport { 80, 443 } accept tcp dport { 80, 443 } accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
@ -75,7 +75,7 @@ table inet filter {
tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
@ -91,11 +91,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, http, powerdns, geoipupdate } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, http, powerdns, geoipupdate } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept
skuid { chrony, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid { chrony, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept

8
nftables-ns2.conf
View File

@ -66,7 +66,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
udp dport 53 accept udp dport 53 accept
tcp dport { 80, 443 } accept tcp dport { 80, 443 } accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
@ -80,7 +80,7 @@ table inet filter {
tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
@ -96,11 +96,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, http, powerdns, geoipupdate } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, http, powerdns, geoipupdate } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept
skuid { chrony, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid { chrony, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept

8
nftables-social.conf
View File

@ -49,7 +49,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
tcp dport { 80, 443 } accept tcp dport { 80, 443 } accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
ct state vmap { established : accept, related : accept, new : goto graceful-reject } ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@ -59,7 +59,7 @@ table inet filter {
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
accept accept
@ -73,11 +73,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, http, mastodon } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, http, mastodon } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept
skuid { chrony, mastodon } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid { chrony, mastodon } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept

8
nftables-web.conf
View File

@ -53,7 +53,7 @@ table inet filter {
type filter hook input priority filter type filter hook input priority filter
policy drop policy drop
iif lo goto input-internal iif lo goto input-loopback
tcp dport { 80, 443 } accept tcp dport { 80, 443 } accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
ct state vmap { established : accept, related : accept, new : goto graceful-reject } ct state vmap { established : accept, related : accept, new : goto graceful-reject }
@ -63,7 +63,7 @@ table inet filter {
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
} }
chain input-internal { chain input-loopback {
tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
accept accept
@ -77,11 +77,11 @@ table inet filter {
chain output { chain output {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-loopback
skuid != { root, systemd-network, unbound, chrony, http } counter goto graceful-reject skuid != { root, systemd-network, unbound, chrony, http } counter goto graceful-reject
} }
chain output-internal { chain output-loopback {
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept
skuid chrony meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept skuid chrony meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept