Hyperion Entertainment Message Boards

Code: Select all

#!/usr/sbin/nft -f

# Delete all existing firewall rules 
flush ruleset

# Set up an IPv4 and an IPv6 firewall table 
table inet filter {
# Incoming Connections: Block everything by default. The input chain processes incoming network packets. Anything that has not been explicitly allowed is discarded. 
       chain input {
               type filter hook input priority filter; policy drop;
# Allow network traffic via localhost. This allows the computer to communicate with itself. 
               iifname lo accept
# However, two exceptions are allowed for incoming packets. 
# established -> Incoming packets are part of an already established connection  
# related -> Incoming packets are part of an already established connection (though the second port can be opened) 
               ct state vmap { established : accept, related : accept }
# Certain ICMP packets are allowed (echo-request -> ping, echo-reply -> Response to ping, router-solicitation -> Request for Router Information)
               icmp type { echo-reply, echo-request, router-solicitation } accept
# Allow certain ICMPv6 packets 
               icmpv6 type { echo-reply, echo-request, nd-router-solicit, nd-neighbor-solicit } accept
# Allow SSH
               iifname end0 tcp dport 22 accept
       }
# Block forwarded packets 
       chain forward {
               type filter hook forward priority filter; policy drop;
       }
# Outgoing packets are allowed 
       chain output {
               type filter hook output priority filter; policy accept;
       }
}

Code: Select all

table inet filter {
	chain input {
		type filter hook input priority filter; policy drop;
		iifname "lo" accept
		ct state vmap { established : accept, related : accept }
		icmp type { echo-reply, echo-request, router-solicitation } accept
		icmpv6 type { echo-request, echo-reply, nd-router-solicit, nd-neighbor-solicit } accept
		iifname "end0" tcp dport 22 accept
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
	}

	chain output {
		type filter hook output priority filter; policy accept;
	}
}