nftables: add define for ns2.grapheneos.org anycast IP

This commit is contained in:
Daniel Micay 2024-04-18 10:40:29 -04:00
parent 741ea728ea
commit b17b2f3fd3

View File

@ -3,6 +3,8 @@
flush ruleset flush ruleset
table inet filter { table inet filter {
define ip-anycast = 198.251.90.93
define ip-allowlist-ssh = { define ip-allowlist-ssh = {
198.98.53.141, # 0.ns2.grapheneos.org 198.98.53.141, # 0.ns2.grapheneos.org
} }
@ -46,8 +48,7 @@ table inet filter {
udp dport 53 notrack accept udp dport 53 notrack accept
# reject SSH packets via anycast IP tcp dport 22 ip daddr $ip-anycast reject with tcp reset
tcp dport 22 ip daddr 198.251.90.93 reject with tcp reset
# handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion # handle new TCP connections beyond rate limit via synproxy to avoid conntrack table exhaustion
tcp dport { 22, 53, 80, 443, 853 } tcp flags syn limit rate over 1024/second burst 128 packets counter notrack accept tcp dport { 22, 53, 80, 443, 853 } tcp flags syn limit rate over 1024/second burst 128 packets counter notrack accept