mirror of
https://github.com/GrapheneOS/infrastructure.git
synced 2025-07-05 11:54:39 -04:00
enforce strong host model via nftables
This commit is contained in:
parent
eb55afa3a8
commit
59984a477c
9 changed files with 36 additions and 0 deletions
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
tcp dport {22, 80, 443} notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
}
|
||||
|
|
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
tcp dport {22, 80, 443} notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
}
|
||||
|
|
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
tcp dport {22, 25, 80, 443, 465, 993} notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
}
|
||||
|
|
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
tcp dport {22, 80, 443} notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
}
|
||||
|
|
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
tcp dport {22, 80, 443, 7275} notrack accept
|
||||
udp dport 123 notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
|
|
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
udp dport 53 notrack accept
|
||||
tcp dport {22, 53, 80, 443, 853} notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
|
|
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
udp dport 53 notrack accept
|
||||
tcp dport {22, 53, 80, 443, 853} notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
|
|
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
tcp dport {22, 80, 443} notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
}
|
||||
|
|
|
@ -10,6 +10,10 @@ table inet filter {
|
|||
fib saddr . iif oif missing counter drop
|
||||
|
||||
iif lo notrack accept
|
||||
|
||||
# drop packets to address not configured on incoming interface (strong host model)
|
||||
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
||||
|
||||
tcp dport {22, 80, 443} notrack accept
|
||||
meta l4proto {icmp, ipv6-icmp} notrack accept
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue