49 lines
2.3 KiB
Django/Jinja
49 lines
2.3 KiB
Django/Jinja
#!/usr/sbin/nft -f
|
|
flush ruleset
|
|
|
|
define NET4_SERVER = {{ hostvars['fw']['network4']['subnet']['server'] }}
|
|
define NET6_SERVER = {{ hostvars['fw']['network6']['subnet']['server'] }}
|
|
define HOSTS4_CONSOLE = { {{ hostvars['fw']['network4']['console'].values() | join(', ') }} }
|
|
define HOSTS6_CONSOLE = { {{ hostvars['fw']['network6']['console'].values() | join(', ') }} }
|
|
define PORTS_SSH = 22
|
|
define PORTS_HTTP = 80
|
|
define PORTS_HTTP_FORWARD = 2080
|
|
define PORTS_HTTPS = 443
|
|
define PORTS_HTTPS_FORWARD = 2443
|
|
|
|
table inet nat {
|
|
chain prerouting {
|
|
type nat hook prerouting priority dstnat; policy accept;
|
|
tcp dport $PORTS_HTTP dnat to :$PORTS_HTTP_FORWARD comment "dnat http ports to $PORTS_HTTP_FORWARD"
|
|
tcp dport $PORTS_HTTPS dnat to :$PORTS_HTTPS_FORWARD comment "dnat https ports to $PORTS_HTTPS_FORWARD"
|
|
}
|
|
chain postrouting {
|
|
|
|
}
|
|
chain output {
|
|
type nat hook output priority dstnat; policy accept;
|
|
oifname "lo" tcp dport $PORTS_HTTP dnat to :$PORTS_HTTP_FORWARD comment "dnat http ports to $PORTS_HTTP_FORWARD out of LOCALHOST"
|
|
oifname "lo" tcp dport $PORTS_HTTPS dnat to :$PORTS_HTTPS_FORWARD comment "dnat https ports to $PORTS_HTTPS_FORWARD out of LOCALHOST"
|
|
}
|
|
}
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
ct state invalid drop comment "deny invalid connection"
|
|
ct state established, related accept comment "allow all connection already existing"
|
|
iifname "lo" accept comment "allow local connection: AUTH > AUTH"
|
|
meta l4proto { icmp, icmpv6 } accept comment "allow icmp connection: AUTH"
|
|
ip saddr $HOSTS4_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv4 ssh connection: CONSOLE > AUTH"
|
|
ip6 saddr $HOSTS6_CONSOLE tcp dport $PORTS_SSH accept comment "allow ipv6 ssh connection: CONSOLE > AUTH"
|
|
tcp dport $PORTS_HTTP_FORWARD ct original proto-dst $PORTS_HTTP accept comment "allow ipv4, 6 http connection: > AUTH"
|
|
tcp dport $PORTS_HTTPS_FORWARD ct original proto-dst $PORTS_HTTPS accept comment "allow ipv4, 6 https connection: > AUTH"
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority 0; policy drop;
|
|
}
|
|
chain output {
|
|
type filter hook output priority 0; policy accept;
|
|
}
|
|
}
|