mirror of
https://github.com/ben-grande/qusal.git
synced 2025-01-09 14:39:38 -05:00
692659e22d
- Passwordless as it doesn't compromise security; - Firewall blocks access to the interface in case the pihole is exposed to the internet; - setupVars.conf needs to be 644 for non root commands to the pihole script to work, so the WEB_PASSWORD can be read as normal user, restricting root on pihole does not make sense, as it can modify the network setting via pihole web interface.
36 lines
1.6 KiB
Plaintext
36 lines
1.6 KiB
Plaintext
#!/usr/sbin/nft -f
|
|
# vim: ft=nftables
|
|
# SPDX-FileCopyrightText: 2022 - 2023 unman <unman@thirdeyesecurity.org>
|
|
# SPDX-FileCopyrightText: 2023 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
|
#
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
add chain ip6 qubes dnat-dns { type nat hook prerouting priority dstnat; policy accept; }
|
|
|
|
flush chain ip qubes dnat-dns
|
|
flush chain ip6 qubes dnat-dns
|
|
insert rule ip qubes dnat-dns iifname "vif*" tcp dport 53 dnat to 127.0.0.1
|
|
insert rule ip qubes dnat-dns iifname "vif*" udp dport 53 dnat to 127.0.0.1
|
|
insert rule ip6 qubes dnat-dns iifname "vif*" tcp dport 53 dnat to ::1
|
|
insert rule ip6 qubes dnat-dns iifname "vif*" udp dport 53 dnat to ::1
|
|
|
|
flush chain ip qubes custom-forward
|
|
flush chain ip6 qubes custom-forward
|
|
insert rule ip qubes custom-forward tcp dport 53 drop
|
|
insert rule ip qubes custom-forward udp dport 53 drop
|
|
insert rule ip6 qubes custom-forward tcp dport 53 drop
|
|
insert rule ip6 qubes custom-forward udp dport 53 drop
|
|
|
|
flush chain ip qubes custom-input
|
|
flush chain ip6 qubes custom-input
|
|
## Admin Web Interface
|
|
insert rule ip qubes custom-input iifname != "lo" tcp dport 80 drop
|
|
insert rule ip qubes custom-input iifname != "lo" udp dport 80 drop
|
|
insert rule ip6 qubes custom-input iifname != "lo" tcp dport 80 drop
|
|
insert rule ip6 qubes custom-input iifname != "lo" udp dport 80 drop
|
|
## DNS
|
|
insert rule ip qubes custom-input iifname "vif*" tcp dport 53 accept
|
|
insert rule ip qubes custom-input iifname "vif*" udp dport 53 accept
|
|
insert rule ip6 qubes custom-input iifname "vif*" tcp dport 53 accept
|
|
insert rule ip6 qubes custom-input iifname "vif*" udp dport 53 accept
|