mirror of
https://github.com/GrapheneOS/infrastructure.git
synced 2024-12-22 13:45:02 -05:00
nftables: add comments explaining adding to connlimit sets
This commit is contained in:
parent
edbf50a3da
commit
b928b197b0
@ -82,6 +82,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -91,6 +92,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
@ -82,6 +82,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -91,6 +92,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
@ -82,6 +82,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -91,6 +92,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
@ -82,6 +82,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -91,6 +92,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
@ -86,6 +86,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -95,6 +96,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
@ -85,6 +85,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -94,6 +95,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
@ -90,6 +90,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -99,6 +100,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
@ -82,6 +82,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -91,6 +92,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
@ -86,6 +86,7 @@ table inet filter {
|
||||
accept
|
||||
}
|
||||
|
||||
# add connections established without synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-established {
|
||||
ct mark 0x1 accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
@ -95,6 +96,7 @@ table inet filter {
|
||||
ct mark set 0x1 accept
|
||||
}
|
||||
|
||||
# add connections established with synproxy to connection limit sets with limits enforced
|
||||
chain input-tcp-service-loopback {
|
||||
tcp flags != syn accept
|
||||
tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset
|
||||
|
Loading…
Reference in New Issue
Block a user