initial commit

Signed-off-by: Robert Günzler <r@gnzler.io>

1 files changed, 15 insertions, 0 deletions

diff --git a/bundles/firewall/files/etc/nftables.d/80-podman.nft b/bundles/firewall/files/etc/nftables.d/80-podman.nft
new file mode 100644
index 0000000..90142bc
--- /dev/null
+++ b/bundles/firewall/files/etc/nftables.d/80-podman.nft
@@ -0,0 +1,15 @@
+#!/usr/sbin/nft -f
+# vim: set ts=4 sw=4:
+table inet filter {
+
+    # HACK: this would not be necessary if not for the two chains being
+    # incompatible
+    chain my_filter {
+        ip daddr 10.89.0.0/24 ct state established,related accept \
+        comment "Accept incoming podman traffic"
+
+        ip saddr 10.89.0.0/24 accept \
+        comment "Accept outgoing podman traffic"
+    }
+
+}