Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2024-12-22 21:49:22 -05:00
Code Issues Packages Projects Releases Wiki Activity

nftables: handle non-TCP case in input-new chain

Browse Source
This commit is contained in:
Daniel Micay 2024-04-11 10:34:00 -04:00
parent 8f047de0c3
commit 832a430954
9 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
nftables-attestation.conf
View File

@ -69,6 +69,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 80, 443 } goto graceful-reject tcp dport != { 22, 80, 443 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset

1
nftables-discuss.conf
View File

@ -69,6 +69,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 80, 443 } goto graceful-reject tcp dport != { 22, 80, 443 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset

1
nftables-mail.conf
View File

@ -69,6 +69,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 25, 80, 443, 465, 993 } goto graceful-reject tcp dport != { 22, 25, 80, 443, 465, 993 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset

1
nftables-matrix.conf
View File

@ -69,6 +69,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 80, 443 } goto graceful-reject tcp dport != { 22, 80, 443 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset

1
nftables-network.conf
View File

@ -73,6 +73,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 80, 443, 7275 } goto graceful-reject tcp dport != { 22, 80, 443, 7275 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset

1
nftables-ns1.conf
View File

@ -72,6 +72,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 53, 80, 443, 853 } goto graceful-reject tcp dport != { 22, 53, 80, 443, 853 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset

1
nftables-ns2.conf
View File

@ -77,6 +77,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 53, 80, 443, 853 } goto graceful-reject tcp dport != { 22, 53, 80, 443, 853 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset

1
nftables-social.conf
View File

@ -69,6 +69,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 80, 443 } goto graceful-reject tcp dport != { 22, 80, 443 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset

1
nftables-web.conf
View File

@ -73,6 +73,7 @@ table inet filter {
} }
chain input-new { chain input-new {
meta l4proto != tcp goto graceful-reject
tcp dport != { 22, 80, 443 } goto graceful-reject tcp dport != { 22, 80, 443 } goto graceful-reject
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset