Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-01-03 02:50:47 -05:00
Code Issues Packages Projects Releases Wiki Activity

prepare to move MTA-STS web server to mail server

Browse Source
This commit is contained in:
Daniel Micay 2023-06-21 13:11:36 -04:00
parent 3d869bcac7
commit fdf3839571
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
nftables-mail.conf
View File

@ -7,7 +7,7 @@ table inet filter {
type filter hook prerouting priority raw type filter hook prerouting priority raw
iif lo notrack accept iif lo notrack accept
tcp dport {22, 25, 80, 465, 993} notrack accept tcp dport {22, 25, 80, 443, 465, 993} notrack accept
meta l4proto {icmp, ipv6-icmp} notrack accept meta l4proto {icmp, ipv6-icmp} notrack accept
} }
@ -15,7 +15,7 @@ table inet filter {
type filter hook output priority raw type filter hook output priority raw
oif lo notrack accept oif lo notrack accept
tcp sport {22, 25, 80, 465, 993} notrack accept tcp sport {22, 25, 80, 443, 465, 993} notrack accept
meta l4proto {icmp, ipv6-icmp} notrack accept meta l4proto {icmp, ipv6-icmp} notrack accept
} }
@ -24,8 +24,8 @@ table inet filter {
policy drop policy drop
iif lo accept iif lo accept
tcp dport {22, 25, 80, 465, 993} ip daddr {{ipv4_address}} accept tcp dport {22, 25, 80, 443, 465, 993} ip daddr {{ipv4_address}} accept
tcp dport {22, 25, 80, 465, 993} ip6 daddr {{ipv6_address}} accept tcp dport {22, 25, 80, 443, 465, 993} ip6 daddr {{ipv6_address}} accept
meta l4proto {icmp, ipv6-icmp} accept meta l4proto {icmp, ipv6-icmp} accept
ct state vmap { invalid : drop, established : accept, related : accept } ct state vmap { invalid : drop, established : accept, related : accept }
@ -44,7 +44,7 @@ table inet filter {
type filter hook output priority filter type filter hook output priority filter
oif lo goto output-internal oif lo goto output-internal
skuid != {root, systemd-network, unbound, chrony, postfix, dovecot, dovenull} counter goto output-reject skuid != {root, systemd-network, unbound, chrony, postfix, dovecot, dovenull, http} counter goto output-reject
} }
chain output-internal { chain output-internal {