-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathnftables rules
More file actions
100 lines (64 loc) · 5.19 KB
/
Copy pathnftables rules
File metadata and controls
100 lines (64 loc) · 5.19 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
/// Add Table filter
nft add table ip filter
// Add Input chain
nft add chain ip filter input { type filter hook input priority 0 \; policy drop \; }
// For new connection if tcp doesn't have syn flag set drop it
nft add rule ip filter input iifname enp2s0 tcp flags != syn ct state new drop
// Accept acceptable connections
nft add rule ip filter input iifname lo ct state established,related accept
nft add rule ip filter input iifname enp2s0 ct state new,established,related accept
// Droppping udp length if is in the range of 28-32
nft add rule ip filter input iifname enp2s0 udp length { 28-32 } drop
// Dropping spoofing address
nft add rule ip filter input iifname enp2s0 ip saddr 10.0.0.0/8 drop
nft add rule ip filter input iifname enp2s0 ip saddr 172.16.0.0/12 drop
nft add rule ip filter input iifname enp2s0 ip saddr 192.168.0.0/16 drop
nft add rule ip filter input iifname enp2s0 ip saddr 224.0.0.0/4 drop
nft add rule ip filter input iifname enp2s0 ip daddr 224.0.0.0/4 ip protocol != udp drop
nft add rule ip filter input iifname enp2s0 ip saddr 240.0.0.0/5 drop
nft add rule ip filter input iifname enp2s0 ip saddr 127.0.0.0/8 drop
nft add rule ip filter input iifname enp2s0 ip saddr 255.255.255.255 drop
nft add rule ip filter input iifname enp2s0 ip daddr 255.255.255.255 drop
nft add rule ip filter input iifname enp2s0 ip saddr 169.254.0.0/16 drop
nft add rule ip filter input iifname enp2s0 ip saddr 0.0.0.0/8 drop
nft add rule ip filter input iifname enp2s0 ip daddr 0.0.0.0/8 drop
//Dropping TCP stealth scan
nft add rule ip filter input iifname enp2s0 tcp flags \& \(syn\|fin\) == \(syn\|fin\) drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(syn\|rst\) == \(syn\|rst\) drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(fin\|rst\) == \(fin\|rst\) drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(ack\|fin\) == fin drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(ack\|psh\) == psh drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(ack\|urg\) == urg drop
//Dropping Null scan
nft add rule ip filter input iifname enp2s0 tcp flags \& \(fin\|syn\|rst\|psh\|ack\|urg\) \< fin drop
// Dropping Xmas Scan
nft add rule ip filter input iifname enp2s0 tcp flags \& \(fin\|syn\|rst\|psh\|ack\|urg\) == \(fin\|psh\|urg\) drop
// Dropping Misc scan rules
nft add rule ip filter input iifname enp2s0 tcp flags \& \(fin\|syn\|rst\|psh\|ack\|urg\) == \(ack\|rst\|syn\|fin\) drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(fin\|syn\|rst\|psh\|ack\|urg\) == \(fin\|syn\|rst\|psh\|ack\|urg\) drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(fin\|syn\|rst\|psh\|ack\|urg\) == \(syn\|rst\|ack\|fin\|urg\) drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(fin\|syn\|rst\|psh\|ack\|urg\) == fin drop
nft add rule ip filter input iifname enp2s0 tcp flags \& \(syn\|ack\|fin\|rst\) == rst drop
// Icmp limit rate and acceptable icmp types have to be combined in nftables. remember to give space for every type
nft add rule ip filter input iifname enp2s0 icmp type { echo-reply, destination-unreachable, time-exceeded } limit rate 1/second accept
// Reject every other icmp type explicitly, Types split for brevity
nft add rule ip filter input iifname enp2s0 icmp type { source-quench, redirect, echo-request, parameter-problem } drop
nft add rule ip filter input iifname enp2s0 icmp type { timestamp-request, timestamp-reply, info-request, info-reply } drop
nft add rule ip filter input iifname enp2s0 icmp type { address-mask-request, address-mask-reply, router-advertisement, router-solicitation} drop
// Dropping invalid and untracked packets and logging them. we can't give limit rate to log prefix at the moment.
nft add rule ip filter input iifname enp2s0 ct state invalid,untracked log flags all level info prefix \"Invalid-Input: \"
nft add rule ip filter input iifname enp2s0 ct state invalid,untracked drop
// Forward policy
nft add chain ip filter forward { type filter hook forward priority 0\; counter\; policy drop\;}
nft add rule ip filter forward ct state established,related accept
nft add rule ip filter forward ct state invalid,untracked drop
// Output Policy
nft add chain ip filter output { type filter hook output priority 0 \; counter \; policy drop \; }
nft add rule ip filter output oifname lo ct state established,related accept
nft add rule ip filter output oifname enp2s0 ct state new,established,related accept
nft add rule ip filter output oifname enp2s0 icmp type {echo-request, destination-unreachable, time-exceeded} limit rate 1/second accept
nft add rule ip filter output oifname enp2s0 icmp type {echo-reply, source-quench, redirect, parameter-problem } drop
nft add rule ip filter output oifname enp2s0 icmp type { timestamp-request, timestamp-reply, info-request, info-reply } drop
nft add rule ip filter output oifname enp2s0 icmp type { address-mask-request, address-mask-reply, router-advertisement, router-solicitation} drop
nft add rule ip filter input oifname enp2s0 ct state invalid,untracked log flags all level info prefix \"Invalid-Output: \"
nft add rule ip filter output oifname enp2s0 ct state invalid,untracked drop