Hi All,
Here is a simple configuration of a desktop firewall with NFTables.
/etc/nftables.conf:
Code: Select all
#!/usr/sbin/nft -f
# Delete all existing firewall rules
flush ruleset
# Set up an IPv4 and an IPv6 firewall table
table inet filter {
# Incoming Connections: Block everything by default. The input chain processes incoming network packets. Anything that has not been explicitly allowed is discarded.
chain input {
type filter hook input priority filter; policy drop;
# Allow network traffic via localhost. This allows the computer to communicate with itself.
iifname lo accept
# However, two exceptions are allowed for incoming packets.
# established -> Incoming packets are part of an already established connection
# related -> Incoming packets are part of an already established connection (though the second port can be opened)
ct state vmap { established : accept, related : accept }
# Certain ICMP packets are allowed (echo-request -> ping, echo-reply -> Response to ping, router-solicitation -> Request for Router Information)
icmp type { echo-reply, echo-request, router-solicitation } accept
# Allow certain ICMPv6 packets
icmpv6 type { echo-reply, echo-request, nd-router-solicit, nd-neighbor-solicit } accept
# Allow SSH
iifname end0 tcp dport 22 accept
}
# Block forwarded packets
chain forward {
type filter hook forward priority filter; policy drop;
}
# Outgoing packets are allowed
chain output {
type filter hook output priority filter; policy accept;
}
}
View current settings: nft list ruleset
Code: Select all
table inet filter {
chain input {
type filter hook input priority filter; policy drop;
iifname "lo" accept
ct state vmap { established : accept, related : accept }
icmp type { echo-reply, echo-request, router-solicitation } accept
icmpv6 type { echo-request, echo-reply, nd-router-solicit, nd-neighbor-solicit } accept
iifname "end0" tcp dport 22 accept
}
chain forward {
type filter hook forward priority filter; policy drop;
}
chain output {
type filter hook output priority filter; policy accept;
}
}
NFTables on Void PPC:
Cheers,
Christian