Git-Mirrors
/
graphene-os-server-infrastructure
mirror of https://github.com/GrapheneOS/infrastructure.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

nftables: avoid unnecessary connection marking

This commit is contained in:
Daniel Micay 2024-04-11 11:30:58 -04:00
parent 832a430954
commit b152574da8
9 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nftables-attestation.conf
View File

@ -79,6 +79,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -88,6 +90,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset

4
nftables-discuss.conf
View File

@ -79,6 +79,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -88,6 +90,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset

4
nftables-mail.conf
View File

@ -79,6 +79,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 25, 80, 443, 465, 993 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -88,6 +90,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 25, 80, 443, 465, 993 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset

4
nftables-matrix.conf
View File

@ -79,6 +79,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -88,6 +90,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset

4
nftables-network.conf
View File

@ -83,6 +83,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443, 7275 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -92,6 +94,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443, 7275 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset

4
nftables-ns1.conf
View File

@ -82,6 +82,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 53, 80, 443, 853 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -91,6 +93,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 53, 80, 443, 853 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset

4
nftables-ns2.conf
View File

@ -87,6 +87,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 53, 80, 443, 853 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -96,6 +98,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 53, 80, 443, 853 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset

4
nftables-social.conf
View File

@ -79,6 +79,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -88,6 +90,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset

4
nftables-web.conf
View File

@ -83,6 +83,8 @@ table inet filter {
}
chain input-established {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
ct mark 0x1 accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset
@ -92,6 +94,8 @@ table inet filter {
}
chain input-loopback {
meta l4proto != tcp accept
tcp dport != { 22, 80, 443 } accept
tcp flags != syn accept
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset