]> Git — Sourcephile - sourcephile-nix.git/blob - var/nftables/filter.txt
coredump: set MaxUse=
[sourcephile-nix.git] / var / nftables / filter.txt
1 # A set containing the udp port(s) to which SSDP replies are allowed.
2 set ssdp_out {
3 type inet_service
4 timeout 5s
5 }
6 set lograte4 { type ipv4_addr; size 65535; flags dynamic; }
7 set lograte6 { type ipv6_addr; size 65535; flags dynamic; }
8 chain block {
9 add @lograte4 { ip saddr limit rate 1/minute } log level warn prefix "block: "
10 add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "block: "
11 counter drop
12 }
13 chain ping-flood {
14 add @lograte4 { ip saddr limit rate 1/minute } log level warn prefix "ping-flood: "
15 add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "ping-flood: "
16 counter drop
17 }
18 chain smurf {
19 add @lograte4 { ip saddr limit rate 1/minute } log level warn prefix "smurf: "
20 add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "smurf: "
21 counter drop
22 }
23 chain bogus-tcp {
24 add @lograte4 { ip saddr limit rate 1/minute } log level warn prefix "bogus-tcp: "
25 add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "bogus-tcp: "
26 counter drop
27 }
28 chain syn-flood {
29 add @lograte4 { ip saddr limit rate 1/minute } log level warn prefix "syn-flood: "
30 add @lograte6 { ip6 saddr limit rate 1/minute } log level warn prefix "syn-flood: "
31 counter drop
32 }
33 chain check-tcp {
34 tcp flags syn tcp option maxseg size != 536-65535 counter goto bogus-tcp
35 tcp flags & (ack|fin) == fin counter goto bogus-tcp
36 tcp flags & (ack|psh) == psh counter goto bogus-tcp
37 tcp flags & (ack|urg) == urg counter goto bogus-tcp
38 tcp flags & (fin|ack) == fin counter goto bogus-tcp
39 tcp flags & (fin|rst) == (fin|rst) counter goto bogus-tcp
40 tcp flags & (fin|psh|ack) == (fin|psh) counter goto bogus-tcp
41 tcp flags & (syn|fin) == (syn|fin) counter goto bogus-tcp comment "SYN-FIN scan"
42 tcp flags & (syn|rst) == (syn|rst) counter goto bogus-tcp comment "SYN-RST scan"
43 tcp flags == (fin|syn|rst|psh|ack|urg) counter goto bogus-tcp comment "XMAS scan"
44 tcp flags == 0x0 counter goto bogus-tcp comment "NULL scan"
45 tcp flags == (fin|urg|psh) counter goto bogus-tcp
46 tcp flags == (fin|urg|psh|syn) counter goto bogus-tcp comment "NMAP-ID"
47 tcp flags == (fin|urg|syn|rst|ack) counter goto bogus-tcp
48
49 ct state new tcp flags != syn counter goto bogus-tcp
50 tcp sport 0 tcp flags & (fin|syn|rst|ack) == syn counter goto bogus-tcp
51 tcp flags & (fin|syn|rst|ack) == syn counter limit rate over 30/second burst 60 packets goto syn-flood
52 }
53 chain spoofing {
54 add @lograte4 { ip saddr limit rate 1/minute } log level warn prefix "spoofing: "
55 counter drop
56 }
57 chain check-broadcast {
58 #ip saddr 0.0.0.0/32 counter accept comment "DHCP broadcast"
59 fib saddr type broadcast counter goto smurf
60 #ip saddr 224.0.0.0/4 counter goto smurf
61 }
62 chain check-ping {
63 ip protocol icmp icmp type echo-request limit rate over 10/second burst 20 packets goto ping-flood
64 ip6 nexthdr ipv6-icmp icmpv6 type echo-request limit rate over 10/second burst 20 packets goto ping-flood
65 }
66 chain check-public {
67 ip saddr 0.0.0.0/8 counter goto spoofing
68 ip saddr 10.0.0.0/8 counter goto spoofing
69 ip saddr 127.0.0.0/8 counter goto spoofing
70 ip saddr 169.254.0.0/16 counter goto spoofing
71 ip saddr 172.16.0.0/12 counter goto spoofing
72 ip saddr 192.0.2.0/24 counter goto spoofing
73 ip saddr 192.168.0.0/16 counter goto spoofing
74 ip saddr 224.0.0.0/3 counter goto spoofing
75 ip saddr 240.0.0.0/5 counter goto spoofing
76 }
77 chain accept-icmpv6 {
78 # Traffic That Must Not Be Dropped
79 # https://tools.ietf.org/html/rfc4890#section-4.4.1
80 icmpv6 type destination-unreachable counter accept
81 icmpv6 type packet-too-big counter accept
82 icmpv6 type time-exceeded counter accept
83 icmpv6 type parameter-problem counter accept
84
85 # Address Configuration and Router Selection messages
86 # (must be received with hop limit = 255)
87 icmpv6 type nd-router-solicit ip6 hoplimit 255 counter accept
88 ip6 nexthdr ipv6-icmp icmpv6 type nd-router-advert ip6 hoplimit 255 counter accept
89 icmpv6 type nd-neighbor-solicit ip6 hoplimit 255 counter accept
90 icmpv6 type nd-neighbor-advert ip6 hoplimit 255 counter accept
91 icmpv6 type nd-redirect ip6 hoplimit 255 log level warn prefix "icmpv6: nd-redirect: " counter drop
92 icmpv6 type ind-neighbor-solicit ip6 hoplimit 255 counter accept
93 icmpv6 type ind-neighbor-advert ip6 hoplimit 255 counter accept
94
95 # Link-local multicast receiver notification messages
96 # (must have link-local source address)
97 icmpv6 type mld-listener-query ip6 saddr fe80::/10 counter accept
98 icmpv6 type mld-listener-report ip6 saddr fe80::/10 counter accept
99 icmpv6 type mld-listener-done ip6 saddr fe80::/10 counter accept
100 # https://tools.ietf.org/html/rfc3810 Multicast Listener Discovery Version 2 (MLDv2) for IPv6
101 icmpv6 type mld2-listener-report ip6 saddr fe80::/10 counter accept
102
103 # SEND Certificate Path notification messages
104 # (must be received with hop limit = 255)
105 icmpv6 type 148 ip6 hoplimit 255 counter accept comment "certificate-path-solicitation"
106 icmpv6 type 149 ip6 hoplimit 255 counter accept comment "certificate-path-advertisement"
107
108 # Multicast Router Discovery messages
109 # (must have link-local source address and hop limit = 1)
110 icmpv6 type 151 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-advertisement"
111 icmpv6 type 152 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-solicitation"
112 icmpv6 type 153 ip6 saddr fe80::/10 ip6 hoplimit 1 counter accept comment "multicast-router-termination"
113 }
114 chain accept-connectivity-input {
115 # Connectivity checking messages
116 # (multicast) ping
117 ip protocol icmp icmp type echo-reply counter accept
118
119 # drop packets with rh0 headers
120 rt type 0 jump block
121 rt type 0 jump block
122 rt type 0 jump block
123
124 # (multicast) ping
125 ip6 nexthdr ipv6-icmp icmpv6 type echo-reply counter accept
126 #ct state invalid counter drop
127
128 ip protocol icmp icmp type destination-unreachable counter accept
129 ip protocol icmp icmp type time-exceeded counter accept
130 ip protocol icmp icmp type parameter-problem counter accept
131 ip protocol icmp icmp type echo-request limit rate over 10/second burst 20 packets goto ping-flood
132 ip protocol icmp icmp type echo-request counter accept
133 # echo-reply is handled before invalid packets to allow multicast ping
134 # which do not have an associated connection.
135
136 ip6 nexthdr ipv6-icmp jump accept-icmpv6
137
138 # Connectivity checking messages
139 icmpv6 type echo-request counter accept
140 # echo-reply is handled before invalid because of multicast
141 }
142 chain accept-connectivity-output {
143 ip protocol icmp counter accept
144 meta skuid 0 udp dport 33434-33523 counter accept comment "traceroute"
145
146 ip6 nexthdr ipv6-icmp jump accept-icmpv6
147
148 # Connectivity checking messages
149 ip6 nexthdr ipv6-icmp icmpv6 type echo-request counter accept
150 ip6 nexthdr ipv6-icmp icmpv6 type echo-reply counter accept
151 }
152 chain accept-connectivity-forward {
153 ip protocol icmp icmp type destination-unreachable counter accept
154 ip protocol icmp icmp type time-exceeded counter accept
155 ip protocol icmp icmp type parameter-problem counter accept
156 ip protocol icmp icmp type echo-request counter accept
157
158 # Traffic That Must Not Be Dropped
159 # https://tools.ietf.org/html/rfc4890#section-4.3.1
160 ip6 nexthdr ipv6-icmp icmpv6 type destination-unreachable counter accept
161 ip6 nexthdr ipv6-icmp icmpv6 type packet-too-big counter accept
162 ip6 nexthdr ipv6-icmp icmpv6 type time-exceeded counter accept
163 ip6 nexthdr ipv6-icmp icmpv6 type parameter-problem counter accept
164
165 # Connectivity checking messages
166 ip6 nexthdr ipv6-icmp icmpv6 type echo-request counter accept
167 ip6 nexthdr ipv6-icmp icmpv6 type echo-reply counter accept
168
169 # Traffic That Normally Should Not Be Dropped
170 # https://tools.ietf.org/html/rfc4890#section-4.3.2
171 ip6 nexthdr ipv6-icmp icmpv6 type 144 counter accept comment "home-agent-address-discovery-request"
172 ip6 nexthdr ipv6-icmp icmpv6 type 145 counter accept comment "home-agent-address-discovery-reply"
173 ip6 nexthdr ipv6-icmp icmpv6 type 146 counter accept comment "mobile-prefix-solicitation"
174 ip6 nexthdr ipv6-icmp icmpv6 type 147 counter accept comment "mobile-prefix-advertisement"
175 }