From 811fcf593e82d05d73fe4ea5af11b81a5cc3f1c7 Mon Sep 17 00:00:00 2001
From: Daniel Micay <daniel.micay@grapheneos.org>
Date: Thu, 28 Mar 2024 12:35:29 -0400
Subject: [PATCH] enforce IPv6 DNS connection limit for /64 blocks

---
 nftables-ns1.conf | 4 ++--
 nftables-ns2.conf | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/nftables-ns1.conf b/nftables-ns1.conf
index a294f41..3432051 100644
--- a/nftables-ns1.conf
+++ b/nftables-ns1.conf
@@ -64,7 +64,7 @@ table inet filter {
         iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
         iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
         iif lo tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
-        iif lo tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr ct count over 16 } reject with tcp reset
+        iif lo tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } reject with tcp reset
 
         iif lo accept
         udp dport 53 accept
@@ -76,7 +76,7 @@ table inet filter {
         tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh reject with tcp reset
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
         tcp dport { 53, 853 } ip saddr @ip-connlimit-dns reject with tcp reset
-        tcp dport { 53, 853 } ip6 saddr @ip6-connlimit-dns reject with tcp reset
+        tcp dport { 53, 853 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-dns reject with tcp reset
         tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
     }
 
diff --git a/nftables-ns2.conf b/nftables-ns2.conf
index 9a08933..b068ad5 100644
--- a/nftables-ns2.conf
+++ b/nftables-ns2.conf
@@ -69,7 +69,7 @@ table inet filter {
         iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
         iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
         iif lo tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
-        iif lo tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr ct count over 16 } reject with tcp reset
+        iif lo tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 16 } reject with tcp reset
 
         iif lo accept
         udp dport 53 accept
@@ -81,7 +81,7 @@ table inet filter {
         tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh reject with tcp reset
         tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
         tcp dport { 53, 853 } ip saddr @ip-connlimit-dns reject with tcp reset
-        tcp dport { 53, 853 } ip6 saddr @ip6-connlimit-dns reject with tcp reset
+        tcp dport { 53, 853 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-dns reject with tcp reset
         tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
     }