diff --git a/nftables-attestation.conf b/nftables-attestation.conf index 0b5ab7b..d5478ea 100644 --- a/nftables-attestation.conf +++ b/nftables-attestation.conf @@ -21,12 +21,12 @@ table inet filter { flags dynamic } - set ip-connlimit-http { + set ip-connlimit-main { type ipv4_addr flags dynamic } - set ip6-connlimit-http { + set ip6-connlimit-main { type ipv6_addr flags dynamic } @@ -58,8 +58,8 @@ table inet filter { tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset - tcp dport 80 ip saddr @ip-connlimit-http counter reject with tcp reset - tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-http counter reject with tcp reset + tcp dport 80 ip saddr @ip-connlimit-main counter reject with tcp reset + tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 22, 80 } synproxy mss 1460 wscale 7 timestamp sack-perm } @@ -67,8 +67,8 @@ table inet filter { tcp flags != syn accept tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset - tcp dport 80 add @ip-connlimit-http { ip saddr ct count over 32 } counter reject with tcp reset - tcp dport 80 add @ip6-connlimit-http { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip-connlimit-main { ip saddr ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset accept } diff --git a/nftables-discuss.conf b/nftables-discuss.conf index 67534d2..61a31d4 100644 --- a/nftables-discuss.conf +++ b/nftables-discuss.conf @@ -21,12 +21,12 @@ table inet filter { flags dynamic } - set ip-connlimit-http { + set ip-connlimit-main { type ipv4_addr flags dynamic } - set ip6-connlimit-http { + set ip6-connlimit-main { type ipv6_addr flags dynamic } @@ -61,8 +61,8 @@ table inet filter { tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset - tcp dport 80 ip saddr @ip-connlimit-http counter reject with tcp reset - tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-http counter reject with tcp reset + tcp dport 80 ip saddr @ip-connlimit-main counter reject with tcp reset + tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 22, 80 } synproxy mss 1460 wscale 7 timestamp sack-perm } @@ -70,8 +70,8 @@ table inet filter { tcp flags != syn accept tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset - tcp dport 80 add @ip-connlimit-http { ip saddr ct count over 32 } counter reject with tcp reset - tcp dport 80 add @ip6-connlimit-http { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip-connlimit-main { ip saddr ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset accept } diff --git a/nftables-mail.conf b/nftables-mail.conf index 3e47431..50badb7 100644 --- a/nftables-mail.conf +++ b/nftables-mail.conf @@ -21,12 +21,12 @@ table inet filter { flags dynamic } - set ip-connlimit-http { + set ip-connlimit-main { type ipv4_addr flags dynamic } - set ip6-connlimit-http { + set ip6-connlimit-main { type ipv6_addr flags dynamic } @@ -58,8 +58,8 @@ table inet filter { tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset - tcp dport { 80, 443 } ip saddr @ip-connlimit-http counter reject with tcp reset - tcp dport { 80, 443 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-http counter reject with tcp reset + tcp dport { 80, 443 } ip saddr @ip-connlimit-main counter reject with tcp reset + tcp dport { 80, 443 } ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 22, 80, 443 } synproxy mss 1460 wscale 7 timestamp sack-perm } @@ -67,8 +67,8 @@ table inet filter { tcp flags != syn accept tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset - tcp dport { 80, 443 } add @ip-connlimit-http { ip saddr ct count over 32 } counter reject with tcp reset - tcp dport { 80, 443 } add @ip6-connlimit-http { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset + tcp dport { 80, 443 } add @ip-connlimit-main { ip saddr ct count over 32 } counter reject with tcp reset + tcp dport { 80, 443 } add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset accept } diff --git a/nftables-matrix.conf b/nftables-matrix.conf index af985a7..e49465f 100644 --- a/nftables-matrix.conf +++ b/nftables-matrix.conf @@ -21,12 +21,12 @@ table inet filter { flags dynamic } - set ip-connlimit-http { + set ip-connlimit-main { type ipv4_addr flags dynamic } - set ip6-connlimit-http { + set ip6-connlimit-main { type ipv6_addr flags dynamic } @@ -58,8 +58,8 @@ table inet filter { tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset - tcp dport 80 ip saddr @ip-connlimit-http counter reject with tcp reset - tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-http counter reject with tcp reset + tcp dport 80 ip saddr @ip-connlimit-main counter reject with tcp reset + tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 22, 80 } synproxy mss 1460 wscale 7 timestamp sack-perm } @@ -67,8 +67,8 @@ table inet filter { tcp flags != syn accept tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset - tcp dport 80 add @ip-connlimit-http { ip saddr ct count over 32 } counter reject with tcp reset - tcp dport 80 add @ip6-connlimit-http { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip-connlimit-main { ip saddr ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset accept } diff --git a/nftables-network.conf b/nftables-network.conf index 4f9ed20..1a20160 100644 --- a/nftables-network.conf +++ b/nftables-network.conf @@ -23,12 +23,12 @@ table inet filter { flags dynamic } - set ip-connlimit-supl { + set ip-connlimit-main { type ipv4_addr flags dynamic } - set ip6-connlimit-supl { + set ip6-connlimit-main { type ipv6_addr flags dynamic } @@ -62,8 +62,8 @@ table inet filter { tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset - tcp dport 7275 ip saddr @ip-connlimit-supl counter reject with tcp reset - tcp dport 7275 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-supl counter reject with tcp reset + tcp dport 7275 ip saddr @ip-connlimit-main counter reject with tcp reset + tcp dport 7275 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 22, 7275 } synproxy mss 1460 wscale 7 timestamp sack-perm } @@ -71,8 +71,8 @@ table inet filter { tcp flags != syn accept tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset - tcp dport 7275 add @ip-connlimit-supl { ip saddr ct count over 32 } counter reject with tcp reset - tcp dport 7275 add @ip6-connlimit-supl { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset + tcp dport 7275 add @ip-connlimit-main { ip saddr ct count over 32 } counter reject with tcp reset + tcp dport 7275 add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset accept } diff --git a/nftables-social.conf b/nftables-social.conf index ac9ad67..da46813 100644 --- a/nftables-social.conf +++ b/nftables-social.conf @@ -21,12 +21,12 @@ table inet filter { flags dynamic } - set ip-connlimit-http { + set ip-connlimit-main { type ipv4_addr flags dynamic } - set ip6-connlimit-http { + set ip6-connlimit-main { type ipv6_addr flags dynamic } @@ -58,8 +58,8 @@ table inet filter { tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset - tcp dport 80 ip saddr @ip-connlimit-http counter reject with tcp reset - tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-http counter reject with tcp reset + tcp dport 80 ip saddr @ip-connlimit-main counter reject with tcp reset + tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 22, 80 } synproxy mss 1460 wscale 7 timestamp sack-perm } @@ -67,8 +67,8 @@ table inet filter { tcp flags != syn accept tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset - tcp dport 80 add @ip-connlimit-http { ip saddr ct count over 32 } counter reject with tcp reset - tcp dport 80 add @ip6-connlimit-http { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip-connlimit-main { ip saddr ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset accept } diff --git a/nftables-web.conf b/nftables-web.conf index f0bdb3f..167f3cc 100644 --- a/nftables-web.conf +++ b/nftables-web.conf @@ -25,12 +25,12 @@ table inet filter { flags dynamic } - set ip-connlimit-http { + set ip-connlimit-main { type ipv4_addr flags dynamic } - set ip6-connlimit-http { + set ip6-connlimit-main { type ipv6_addr flags dynamic } @@ -62,8 +62,8 @@ table inet filter { tcp dport 22 ip saddr @ip-connlimit-ssh counter reject with tcp reset tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh counter reject with tcp reset - tcp dport 80 ip saddr @ip-connlimit-http counter reject with tcp reset - tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-http counter reject with tcp reset + tcp dport 80 ip saddr @ip-connlimit-main counter reject with tcp reset + tcp dport 80 ip6 saddr and ffff:ffff:ffff:ffff:: @ip6-connlimit-main counter reject with tcp reset tcp dport { 22, 80 } synproxy mss 1460 wscale 7 timestamp sack-perm } @@ -71,8 +71,8 @@ table inet filter { tcp flags != syn accept tcp dport 22 ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } counter reject with tcp reset tcp dport 22 ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } counter reject with tcp reset - tcp dport 80 add @ip-connlimit-http { ip saddr ct count over 32 } counter reject with tcp reset - tcp dport 80 add @ip6-connlimit-http { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip-connlimit-main { ip saddr ct count over 32 } counter reject with tcp reset + tcp dport 80 add @ip6-connlimit-main { ip6 saddr and ffff:ffff:ffff:ffff:: ct count over 32 } counter reject with tcp reset accept }