ArchLinux-Hardened/rootfs/etc/nftables.conf at master · ShellCode33/ArchLinux-Hardened · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#!/sbin/nft -f

flush ruleset

table inet filter {
  chain input {
    type filter hook input priority 0; policy drop;
    ct state invalid counter drop comment "early drop of invalid packets"

    # https://googleprojectzero.blogspot.com/2015/01/finding-and-exploiting-ntpd.html
    iif lo accept comment "accept loopback"
    iif != lo ip daddr 127.0.0.1/8 counter drop comment "drop connections to loopback not coming from loopback"
    iif != lo ip6 daddr ::1/128 counter drop comment "drop connections to loopback not coming from loopback"

    # Rate limit ICMP echo-request to prevent flood
    ip protocol icmp icmp type echo-request limit rate 3/second accept
    ip protocol icmp icmp type echo-request counter drop

    # Accept already established/related connections
    ct state {established, related} counter accept comment "accept all connections related to connections made by us"

    # Accept ICMP (ipv4 only)
    ip protocol icmp counter accept comment "allow ICMPv4 packets"

    # DHCP (not required to get DHCP to work, but useful for renewals)
    udp sport 67 udp dport 68 counter accept comment "allow DHCP traffic over UDP"

    # libvirt related config
    iifname "virbr*" tcp dport 53 counter accept comment "allow VMs to reach the host's DNS server (dnsmasq)"
    iifname "virbr*" udp dport 53 counter accept comment "allow VMs to reach the host's DNS server (dnsmasq)"
    iifname "virbr*" udp dport 67 counter accept comment "allow VMs to reach the host's DHCP server (dnsmasq)"

    # Log any failed inbound traffic attempt
    log flags all prefix "FIREWALL REJECTED INPUT: " counter
  }

  chain forward {
    type filter hook forward priority 0; policy drop;

    # libvirt/docker related config
    iifname "virbr*" counter accept comment "allow VMs to reach the internet through the host"
    iifname "docker*" counter accept comment "allow Docker containers to reach the internet through the host"
    ct state established,related counter accept comment "accept all established/related connections"

    # Log any failed forward traffic attempt
    log flags all prefix "FIREWALL REJECTED FORWARD: " counter

    reject with icmp type port-unreachable comment "explicitly reject packets"
  }

  chain output {
    type filter hook output priority 0; policy drop;

    # Allow reaching localhost services
    oif lo accept comment "accept loopback"

    # Accept already established/related connections
    ct state {established, related} accept comment "accept all connections related to connections made by us"

    # libvirt/docker related config
    oifname "virbr*" counter accept comment "allow the host to reach the VMs"
    oifname "docker*" counter accept comment "allow the host to reach Docker containers"

    # ICMP
    ip protocol icmp counter accept comment "accept all ICMP types"

    # DHCP
    udp sport 68 udp dport 67 counter accept comment "allow DHCP traffic over UDP"

    # NTP
    udp dport 123 counter accept comment "allow NTP traffic over UDP"

    # DNS
    udp dport 53 accept comment "allow DNS traffic over UDP"

    # DNS over TLS (not authenticated yet https://github.com/systemd/systemd/issues/25676#issuecomment-1634810897)
    tcp dport 853 counter accept comment "allow DoT traffic over TCP"

    # SyncThing
    tcp dport 22000 counter accept comment "allow SyncThing traffic"

    # Allow everything for the allow-internet group
    ip protocol tcp meta skgid allow-internet counter accept comment "allow TCP outbound traffic for the allow-internet group"
    ip protocol udp meta skgid allow-internet counter accept comment "allow UDP outbound traffic for the allow-internet group"

    # Log any failed outbound traffic attempt
    log flags all prefix "FIREWALL REJECTED OUTPUT: " counter

    reject with icmp type port-unreachable comment "explicitly reject packets"
  }
}