committing changes in /etc made by "-bash"
Package changes:
This commit is contained in:
@@ -1,64 +0,0 @@
|
||||
# Sample configuration for nftables service.
|
||||
# Load this by calling 'nft -f /etc/nftables/main.nft'.
|
||||
|
||||
# Note about base chain priorities:
|
||||
# The priority values used in these sample configs are
|
||||
# offset by 20 in order to avoid ambiguity when firewalld
|
||||
# is also running which uses an offset of 10. This means
|
||||
# that packets will traverse firewalld first and if not
|
||||
# dropped/rejected there will hit the chains defined here.
|
||||
# Chains created by iptables, ebtables and arptables tools
|
||||
# do not use an offset, so those chains are traversed first
|
||||
# in any case.
|
||||
|
||||
# drop any existing nftables ruleset
|
||||
flush ruleset
|
||||
|
||||
# a common table for both IPv4 and IPv6
|
||||
table inet nftables_svc {
|
||||
|
||||
# protocols to allow
|
||||
set allowed_protocols {
|
||||
type inet_proto
|
||||
elements = { icmp, icmpv6 }
|
||||
}
|
||||
|
||||
# interfaces to accept any traffic on
|
||||
set allowed_interfaces {
|
||||
type ifname
|
||||
elements = { "lo" }
|
||||
}
|
||||
|
||||
# services to allow
|
||||
set allowed_tcp_dports {
|
||||
type inet_service
|
||||
elements = { ssh, 9090 }
|
||||
}
|
||||
|
||||
# this chain gathers all accept conditions
|
||||
chain allow {
|
||||
ct state established,related accept
|
||||
|
||||
meta l4proto @allowed_protocols accept
|
||||
iifname @allowed_interfaces accept
|
||||
tcp dport @allowed_tcp_dports accept
|
||||
}
|
||||
|
||||
# base-chain for traffic to this host
|
||||
chain INPUT {
|
||||
type filter hook input priority filter + 20
|
||||
policy accept
|
||||
|
||||
jump allow
|
||||
reject with icmpx type port-unreachable
|
||||
}
|
||||
}
|
||||
|
||||
# By default, any forwarding traffic is allowed.
|
||||
# Uncomment the following line to filter it based
|
||||
# on the same criteria as input traffic.
|
||||
#include "/etc/nftables/router.nft"
|
||||
|
||||
# Uncomment the following line to enable masquerading of
|
||||
# forwarded traffic. May be used with or without router.nft.
|
||||
#include "/etc/nftables/nat.nft"
|
||||
Reference in New Issue
Block a user