mirror of
https://github.com/GrapheneOS/infrastructure.git
synced 2024-09-28 19:45:41 +00:00
d95752bea6
This reuses the approach in cd59960e7b for
SSH connection limits with the same rationale.
PowerDNS also lacks a way to allowlist an address and was limiting our
ADoT reverse proxy to only being able to make 16 connections to the
backend. We could have worked around that by proxing every TCP DNS
connection but it makes more sense to switch to doing this via nftables
where new TCP connections can be completely avoided.
TCP DNS will be perfectly fine without window scaling and Selective
Acknowledgements for clients without TCP timestamps enabled.
114 lines
3.6 KiB
Plaintext
114 lines
3.6 KiB
Plaintext
#!/usr/bin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
define ip-allowlist-ssh = {
|
|
127.0.0.1,
|
|
}
|
|
|
|
define ip6-allowlist-ssh = {
|
|
::1,
|
|
}
|
|
|
|
set ip-connlimit-ssh {
|
|
type ipv4_addr
|
|
flags dynamic
|
|
}
|
|
|
|
set ip6-connlimit-ssh {
|
|
type ipv6_addr
|
|
flags dynamic
|
|
}
|
|
|
|
set ip-connlimit-dns {
|
|
type ipv4_addr
|
|
flags dynamic
|
|
}
|
|
|
|
set ip6-connlimit-dns {
|
|
type ipv6_addr
|
|
flags dynamic
|
|
}
|
|
|
|
chain prerouting-raw {
|
|
type filter hook prerouting priority raw
|
|
|
|
# drop packets without a reverse path (strict reverse path filtering)
|
|
fib saddr . iif oif missing counter drop
|
|
|
|
iif lo notrack accept
|
|
|
|
# drop packets to address not configured on incoming interface (strong host model)
|
|
fib daddr . iif type != { local, broadcast, multicast } counter drop
|
|
|
|
udp dport 53 notrack accept
|
|
tcp dport { 80, 443 } notrack accept
|
|
tcp dport { 22, 53, 853 } tcp flags syn notrack accept
|
|
meta l4proto { icmp, ipv6-icmp } notrack accept
|
|
}
|
|
|
|
chain output-raw {
|
|
type filter hook output priority raw
|
|
|
|
oif lo notrack accept
|
|
udp sport 53 notrack accept
|
|
tcp sport { 80, 443 } notrack accept
|
|
meta l4proto { icmp, ipv6-icmp } notrack accept
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority filter
|
|
policy drop
|
|
|
|
iif lo tcp dport 22 tcp flags syn ip saddr != $ip-allowlist-ssh add @ip-connlimit-ssh { ip saddr ct count over 1 } reject with tcp reset
|
|
iif lo tcp dport 22 tcp flags syn ip6 saddr != $ip6-allowlist-ssh add @ip6-connlimit-ssh { ip6 saddr and ffff:ffff:ffff:ffff:ffff:: ct count over 1 } reject with tcp reset
|
|
iif lo tcp dport { 53, 853 } tcp flags syn add @ip-connlimit-dns { ip saddr ct count over 16 } reject with tcp reset
|
|
iif lo tcp dport { 53, 853 } tcp flags syn add @ip6-connlimit-dns { ip6 saddr ct count over 16 } reject with tcp reset
|
|
|
|
iif lo accept
|
|
udp dport 53 accept
|
|
tcp dport { 80, 443 } accept
|
|
meta l4proto { icmp, ipv6-icmp } accept
|
|
ct state vmap { established : accept, related : accept, new : goto graceful-reject }
|
|
|
|
tcp dport 22 ip saddr @ip-connlimit-ssh reject with tcp reset
|
|
tcp dport 22 ip6 saddr and ffff:ffff:ffff:ffff:ffff:: @ip6-connlimit-ssh reject with tcp reset
|
|
tcp dport 22 synproxy mss 1460 wscale 7 timestamp sack-perm
|
|
tcp dport { 53, 853 } ip saddr @ip-connlimit-dns reject with tcp reset
|
|
tcp dport { 53, 853 } ip6 saddr @ip6-connlimit-dns reject with tcp reset
|
|
tcp dport { 53, 853 } synproxy mss 1460 wscale 7 timestamp sack-perm
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter
|
|
policy drop
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter
|
|
|
|
oif lo goto output-internal
|
|
skuid != { root, systemd-network, unbound, chrony, http, powerdns, geoipupdate } counter goto graceful-reject
|
|
}
|
|
|
|
chain output-internal {
|
|
skuid unbound meta l4proto { tcp, udp } th sport 53 th dport >= 1024 accept
|
|
skuid { chrony, geoipupdate } meta l4proto { tcp, udp } th sport >= 1024 th dport 53 accept
|
|
|
|
skuid powerdns meta l4proto tcp th sport 54 th dport >= 1024 accept
|
|
skuid http meta l4proto { tcp, udp } th sport >= 1024 th dport 54 accept
|
|
|
|
skuid powerdns meta l4proto tcp th sport 81 th dport >= 1024 accept
|
|
|
|
skuid != root counter goto graceful-reject
|
|
accept
|
|
}
|
|
|
|
chain graceful-reject {
|
|
meta l4proto udp reject
|
|
meta l4proto tcp reject with tcp reset
|
|
reject
|
|
}
|
|
}
|