]> Git — Sourcephile - julm/julm-nix.git/blob - nixos/profiles/networking/nftables.txt
nix: update nixpkgs
[julm/julm-nix.git] / nixos / profiles / networking / nftables.txt
1 table inet filter {
2 set lograte4 { type ipv4_addr; size 65535; flags dynamic; }
3 set lograte6 { type ipv6_addr; size 65535; flags dynamic; }
4 chain block {
5 add @lograte4 { ip saddr limit rate 1/minute }
6 add @lograte6 { ip6 saddr limit rate 1/minute }
7 log level warn prefix "block: " counter drop
8 }
9 chain ping-flood {
10 add @lograte4 { ip saddr limit rate 1/minute }
11 add @lograte6 { ip6 saddr limit rate 1/minute }
12 log level warn prefix "ping-flood: " counter drop
13 }
14 chain smurf {
15 add @lograte4 { ip saddr limit rate 1/minute }
16 add @lograte6 { ip6 saddr limit rate 1/minute }
17 log level warn prefix "smurf: " counter drop
18 }
19 chain bogus-tcp {
20 add @lograte4 { ip saddr limit rate 1/minute }
21 add @lograte6 { ip6 saddr limit rate 1/minute }
22 log level warn prefix "bogus-tcp: " counter drop
23 }
24 chain syn-flood {
25 add @lograte4 { ip saddr limit rate 1/minute }
26 add @lograte6 { ip6 saddr limit rate 1/minute }
27 log level warn prefix "syn-flood: " counter drop
28 }
29 chain check-tcp {
30 tcp flags syn tcp option maxseg size != 536-65535 counter goto bogus-tcp
31 tcp flags & (ack|fin) == fin counter goto bogus-tcp
32 tcp flags & (ack|psh) == psh counter goto bogus-tcp
33 tcp flags & (ack|urg) == urg counter goto bogus-tcp
34 tcp flags & (fin|ack) == fin counter goto bogus-tcp
35 tcp flags & (fin|rst) == (fin|rst) counter goto bogus-tcp
36 tcp flags & (fin|psh|ack) == (fin|psh) counter goto bogus-tcp
37 tcp flags & (syn|fin) == (syn|fin) counter goto bogus-tcp comment "SYN-FIN scan"
38 tcp flags & (syn|rst) == (syn|rst) counter goto bogus-tcp comment "SYN-RST scan"
39 tcp flags == (fin|syn|rst|psh|ack|urg) counter goto bogus-tcp comment "XMAS scan"
40 tcp flags == 0x0 counter goto bogus-tcp comment "NULL scan"
41 tcp flags == (fin|urg|psh) counter goto bogus-tcp
42 tcp flags == (fin|urg|psh|syn) counter goto bogus-tcp comment "NMAP-ID"
43 tcp flags == (fin|urg|syn|rst|ack) counter goto bogus-tcp
44
45 ct state new tcp flags != syn counter goto bogus-tcp
46 tcp sport 0 tcp flags & (fin|syn|rst|ack) == syn counter goto bogus-tcp
47 tcp flags & (fin|syn|rst|ack) == syn counter limit rate over 30/second burst 60 packets goto syn-flood
48 }
49 chain check-broadcast {
50 #ip saddr 0.0.0.0/32 counter accept comment "DHCP broadcast"
51 fib saddr type broadcast counter goto smurf
52 #ip saddr 224.0.0.0/4 counter goto smurf
53 }
54 chain limit-ping {
55 ip protocol icmp icmp type echo-request limit rate over 10/second burst 20 packets goto ping-flood
56 # Note the use `meta nfproto ipv6 meta l4proto ipv6-icmp`
57 # instead of the buggy `ip6 nexthdr ipv6-icmp`.
58 # See https://unix.stackexchange.com/questions/645561/nftables-how-to-set-up-simple-ip-and-port-forwarding#comment1209441_645561
59 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type echo-request limit rate over 10/second burst 20 packets goto ping-flood
60 }
61 chain non-public {
62 add @lograte4 { ip saddr limit rate 1/minute }
63 add @lograte6 { ip6 saddr limit rate 1/minute }
64 log level warn prefix "non-public: " counter drop
65 }
66 chain check-public {
67 ip saddr 0.0.0.0/8 counter goto non-public
68 ip saddr 10.0.0.0/8 counter goto non-public
69 ip saddr 127.0.0.0/8 counter goto non-public
70 ip saddr 169.254.0.0/16 counter goto non-public
71 ip saddr 172.16.0.0/12 counter goto non-public
72 ip saddr 192.0.2.0/24 counter goto non-public
73 ip saddr 192.168.0.0/16 counter goto non-public
74 ip saddr 224.0.0.0/3 counter goto non-public
75 ip saddr 240.0.0.0/5 counter goto non-public
76 ip6 saddr ::/0 counter goto non-public
77 ip6 saddr ::/96 counter goto non-public
78 ip6 saddr ::/128 counter goto non-public
79 ip6 saddr ::1/128 counter goto non-public
80 ip6 saddr ::ffff:0.0.0.0/96 counter goto non-public
81 ip6 saddr ::224.0.0.0/100 counter goto non-public
82 ip6 saddr ::127.0.0.0/104 counter goto non-public
83 ip6 saddr ::0.0.0.0/104 counter goto non-public
84 ip6 saddr ::255.0.0.0/104 counter goto non-public
85 ip6 saddr 0000::/8 counter goto non-public
86 ip6 saddr 0200::/7 counter goto non-public
87 ip6 saddr 3ffe::/16 counter goto non-public
88 ip6 saddr 2001:db8::/32 counter goto non-public
89 ip6 saddr 2002:e000::/20 counter goto non-public
90 ip6 saddr 2002:7f00::/24 counter goto non-public
91 ip6 saddr 2002:0000::/24 counter goto non-public
92 ip6 saddr 2002:ff00::/24 counter goto non-public
93 ip6 saddr 2002:0a00::/24 counter goto non-public
94 ip6 saddr 2002:ac10::/28 counter goto non-public
95 ip6 saddr 2002:c0a8::/32 counter goto non-public
96 ip6 saddr fc00::/7 counter goto non-public
97 ip6 saddr fe80::/10 counter goto non-public
98 ip6 saddr fec0::/10 counter goto non-public
99 ip6 saddr ff00::/8 counter goto non-public
100 }
101 chain accept-icmpv6 {
102 # Traffic That Must Not Be Dropped
103 # https://tools.ietf.org/html/rfc4890#section-4.4.1
104 icmpv6 type destination-unreachable counter accept
105 icmpv6 type packet-too-big counter accept
106 icmpv6 type time-exceeded counter accept
107 icmpv6 type parameter-problem counter accept
108
109 # Address Configuration and Router Selection messages
110 # (must be received with hop limit = 255)
111 icmpv6 type nd-router-solicit ip6 hoplimit 255 counter accept
112 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type nd-router-advert ip6 hoplimit 255 counter accept
113 icmpv6 type nd-neighbor-solicit ip6 hoplimit 255 counter accept
114 icmpv6 type nd-neighbor-advert ip6 hoplimit 255 counter accept
115 icmpv6 type nd-redirect ip6 hoplimit 255 log level warn prefix "icmpv6: nd-redirect: " counter drop
116 icmpv6 type ind-neighbor-solicit ip6 hoplimit 255 counter accept
117 icmpv6 type ind-neighbor-advert ip6 hoplimit 255 counter accept
118
119 # Link-local multicast receiver notification messages
120 # (must have link-local source address)
121 icmpv6 type mld-listener-query ip6 saddr fe80::/10 counter accept
122 icmpv6 type mld-listener-report ip6 saddr fe80::/10 counter accept
123 icmpv6 type mld-listener-done ip6 saddr fe80::/10 counter accept
124 # https://tools.ietf.org/html/rfc3810 Multicast Listener Discovery Version 2 (MLDv2) for IPv6
125 icmpv6 type mld2-listener-report ip6 saddr fe80::/10 counter accept
126
127 # SEND Certificate Path notification messages
128 # (must be received with hop limit = 255)
129 icmpv6 type 148 ip6 hoplimit 255 counter accept comment "certificate-path-solicitation"
130 icmpv6 type 149 ip6 hoplimit 255 counter accept comment "certificate-path-advertisement"
131
132 # Multicast Router Discovery messages
133 # (must have link-local source address and hop limit = 1)
134 icmpv6 type 151 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-advertisement"
135 icmpv6 type 152 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-solicitation"
136 icmpv6 type 153 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-termination"
137 }
138
139 chain input-connectivity {
140 # Connectivity checking messages
141 # (multicast) ping
142 ip protocol icmp icmp type echo-reply counter accept
143
144 # drop packets with rh0 headers
145 rt type 0 jump block
146 rt type 0 jump block
147 rt type 0 jump block
148
149 # (multicast) ping
150 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type echo-reply counter accept
151 #ct state invalid counter drop
152
153 ip protocol icmp icmp type destination-unreachable counter accept
154 ip protocol icmp icmp type time-exceeded counter accept
155 ip protocol icmp icmp type parameter-problem counter accept
156 ip protocol icmp icmp type echo-request limit rate over 10/second burst 20 packets goto ping-flood
157 ip protocol icmp icmp type echo-request counter accept
158 # echo-reply is handled before invalid packets to allow multicast ping
159 # which do not have an associated connection.
160
161 meta nfproto ipv6 meta l4proto ipv6-icmp jump accept-icmpv6
162
163 # Connectivity checking messages
164 icmpv6 type echo-request counter accept
165 # echo-reply is handled before invalid because of multicast
166 }
167 chain input {
168 type filter hook input priority 0
169 policy drop
170 iifname lo accept
171 jump check-tcp
172 jump limit-ping
173 ct state { established, related } accept
174 jump input-connectivity
175 ct state invalid counter drop
176 }
177
178 chain output-connectivity {
179 ip protocol icmp counter accept
180 skuid root udp dport 33434-33523 counter accept comment "traceroute"
181
182 meta nfproto ipv6 meta l4proto ipv6-icmp jump accept-icmpv6
183
184 # Connectivity checking messages
185 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type echo-request counter accept
186 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type echo-reply counter accept
187 }
188 chain output {
189 type filter hook output priority 0
190 policy drop
191 oifname lo accept
192 tcp flags syn tcp option maxseg size set rt mtu
193 ct state { established, related } accept
194 jump output-connectivity
195 }
196
197 chain forward-connectivity {
198 ip protocol icmp icmp type destination-unreachable counter accept
199 ip protocol icmp icmp type time-exceeded counter accept
200 ip protocol icmp icmp type parameter-problem counter accept
201 ip protocol icmp icmp type echo-request counter accept
202
203 # Traffic That Must Not Be Dropped
204 # https://tools.ietf.org/html/rfc4890#section-4.3.1
205 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type destination-unreachable counter accept
206 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type packet-too-big counter accept
207 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type time-exceeded counter accept
208 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type parameter-problem counter accept
209
210 # Connectivity checking messages
211 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type echo-request counter accept
212 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type echo-reply counter accept
213
214 # Traffic That Normally Should Not Be Dropped
215 # https://tools.ietf.org/html/rfc4890#section-4.3.2
216 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type 144 counter accept comment "home-agent-address-discovery-request"
217 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type 145 counter accept comment "home-agent-address-discovery-reply"
218 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type 146 counter accept comment "mobile-prefix-solicitation"
219 meta nfproto ipv6 meta l4proto ipv6-icmp icmpv6 type 147 counter accept comment "mobile-prefix-advertisement"
220 }
221 chain forward {
222 type filter hook forward priority 0
223 policy drop
224 }
225 }
226 table inet nat {
227 chain prerouting {
228 type nat hook prerouting priority filter
229 policy accept
230 }
231 chain postrouting {
232 type nat hook postrouting priority srcnat
233 policy accept
234 }
235 }