IPv6 Firewall Router - Versionsgeschichte

Thomas.will: /* Simple Dual Stack Firewall */

2024-01-31T10:55:41Z

Simple Dual Stack Firewall

Thomas.will: /* Simple Dual Stack Firewall */

2024-01-14T07:05:24Z

Simple Dual Stack Firewall

Thomas.will: /* Simple Dual Stack Firewall */

2024-01-14T07:03:31Z

Simple Dual Stack Firewall

Thomas.will am 14. Januar 2024 um 07:01 Uhr

2024-01-14T07:01:18Z

Thomas.will: /* Simple IPv4 Firwall */

2024-01-14T06:49:18Z

Simple IPv4 Firwall

Thomas.will am 14. Januar 2024 um 06:49 Uhr

2024-01-14T06:49:04Z

Thomas.will am 14. Januar 2024 um 06:48 Uhr

2024-01-14T06:48:53Z

Thomas.will: Die Seite wurde neu angelegt: „

 #!/usr/sbin/nft -f  define local_tcp_ports = { 22 } define webserver = "2a02:24d8:71:2445::102" define wandev = ens4 define landev = ens5 define transit_…“

2024-01-13T13:28:55Z

Die Seite wurde neu angelegt: „<pre> #!/usr/sbin/nft -f define local_tcp_ports = { 22 } define webserver = "2a02:24d8:71:2445::102" define wandev = ens4 define landev = ens5 define transit_…“

Neue Seite

<pre>
#!/usr/sbin/nft -f

define local_tcp_ports = { 22 }
define webserver = "2a02:24d8:71:2445::102"
define wandev = ens4
define landev = ens5
define transit_4 = "192.168.44.0/24"
define transit_6 = "2a02:24d8:71:2444::/64"
define lan_4 = 192.168.45.0/24
define lan_6 = "2a02:24d8:71:2445::/64"

flush ruleset
table inet filter {
chain input {
type filter hook input priority filter; policy drop;
ct state established,related accept
ct state new tcp dport $local_tcp_ports accept
ct state new iifname "lo" accept
ct state new icmp type echo-request accept
ip6 nexthdr icmpv6 accept
log prefix "--nftables-drop-input--"
}
chain forward {
type filter hook forward priority filter; policy drop;
ct state established,related accept
ct state new iif $landev oif $wandev accept
ct state new iif $wandev oif $landev ip6 daddr $webserver tcp dport 80 accept
log prefix "--nftables-drop-forward--"
}

chain output {
type filter hook output priority filter; policy drop;
ct state established,related accept
ip6 nexthdr icmpv6 accept
ct state new accept
log prefix "--nftables-drop-output--"
}
}

table ip nat {
chain postrouting {
type nat hook postrouting priority 100;
oif ens4 masquerade
}
}
</pre>

@@ Zeile 42: / Zeile 42: @@
 		type filter hook input priority filter; policy drop;
 		ct state established,related accept
-		ct state new iif "ens4" tcp dport 22 accept
+		ct state new iif "ens3" tcp dport 22 accept
-		ct state new iif "ens5" accept
+		ct state new iif "ens4" accept
 		ct state new iifname "lo" accept
 		ip6 nexthdr ipv6-icmp accept
@@ Zeile 52: / Zeile 52: @@
 		type filter hook forward priority filter; policy drop;
 		ct state established,related accept
-		ct state new iif "ens5" oif "ens4" accept
+		ct state new iif "ens4" oif "ens3" accept
 		log prefix "--nftables-drop-forward--"
+	}
@@ Zeile 67: / Zeile 67: @@
 	chain postrouting {
 		type nat hook postrouting priority srcnat; policy accept;
-		oif "ens4" masquerade
+		oif "ens3" masquerade
+	}
+}

@@ Zeile 45: / Zeile 45: @@
 		ct state new iif "ens5" accept
 		ct state new iifname "lo" accept
 		ip6 nexthdr ipv6-icmp accept
 		log prefix "--nftables-drop-input--"
@@ Zeile 54: / Zeile 53: @@
 		ct state established,related accept
 		ct state new iif "ens5" oif "ens4" accept
 		log prefix "--nftables-drop-forward--"
+	}

@@ Zeile 42: / Zeile 42: @@
 		type filter hook input priority filter; policy drop;
 		ct state established,related accept
-		ct state new tcp dport 22 accept
+		ct state new iif "ens4" tcp dport 22 accept
 		ct state new iifname "lo" accept
 		ct state new icmp type echo-request accept
@@ Zeile 69: / Zeile 70: @@
 		type nat hook postrouting priority srcnat; policy accept;
 		oif "ens4" masquerade
-−
+	}
 </pre>

@@ Zeile 31: / Zeile 31: @@
+	}
+}
-<pre>
+</pre>

@@ Zeile 1: / Zeile 1: @@
-=Simple IPv4 Firwall
+=Simple IPv4 Firwall=
-</pre>
+<pre>
 table ip filter {
 	chain input {

← Nächstältere Version		Version vom 14. Januar 2024, 06:48 Uhr
Zeile 1:		Zeile 1:
		+	=Simple IPv4 Firwall
		+	</pre>
		+	table ip filter {
		+	chain input {
		+	type filter hook input priority filter; policy drop;
		+	ct state established,related accept
		+	ct state new iif "ens4" tcp dport 22 accept
		+	ct state new iif "ens5" accept
		+	ct state new iifname "lo" accept
		+	log prefix "--nftables-drop-input--"
		+	}
		+
		+	chain forward {
		+	type filter hook forward priority filter; policy drop;
		+	ct state established,related accept
		+	ct state new iif "ens5" oif "ens4" accept
		+	log prefix "--nftables-drop-forward--"
		+	}
		+
		+	chain output {
		+	type filter hook output priority filter; policy drop;
		+	ct state established,related accept
		+	ct state new accept
		+	log prefix "--nftables-drop-output--"
		+	}
		+	}
		+	table ip nat {
		+	chain postrouting {
		+	type nat hook postrouting priority srcnat; policy accept;
		+	oif "ens4" masquerade
		+	}
		+	}
		+	<pre>
		+
		+
		+
		+
		+
	<pre>		<pre>
	#!/usr/sbin/nft -f		#!/usr/sbin/nft -f