Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-01-03 11:00:49 -05:00
Code Issues Packages Projects Releases Wiki Activity

nftables: explain synproxy untracked/invalid cases

Browse Source
This commit is contained in:
Daniel Micay 2024-04-11 10:19:39 -04:00
parent 26a58b2492
commit 8f047de0c3
9 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
nftables-attestation.conf
View File

@ -57,6 +57,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset

2
nftables-discuss.conf
View File

@ -57,6 +57,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset

2
nftables-mail.conf
View File

@ -57,6 +57,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset

2
nftables-matrix.conf
View File

@ -57,6 +57,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset

2
nftables-network.conf
View File

@ -61,6 +61,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
udp dport 123 accept udp dport 123 accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset

2
nftables-ns1.conf
View File

@ -60,6 +60,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
udp dport 53 accept udp dport 53 accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset

2
nftables-ns2.conf
View File

@ -65,6 +65,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
udp dport 53 accept udp dport 53 accept
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset

2
nftables-social.conf
View File

@ -57,6 +57,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset

2
nftables-web.conf
View File

@ -61,6 +61,8 @@ table inet filter {
iif lo goto input-loopback iif lo goto input-loopback
meta l4proto { icmp, ipv6-icmp } accept meta l4proto { icmp, ipv6-icmp } accept
# for synproxy, SYN is untracked and first ACK is invalid which are handled via fallthrough
ct state vmap { new : goto input-new, established : goto input-established, related : accept } ct state vmap { new : goto input-new, established : goto input-established, related : accept }
tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset