From 38be6c13f76e893cf47636257071b440dec0c5b2 Mon Sep 17 00:00:00 2001 From: Robert Günzler Date: Sun, 7 Sep 2025 17:32:13 +0200 Subject: initial commit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Robert Günzler --- bundles/firewall/files/etc/nftables.nft | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 bundles/firewall/files/etc/nftables.nft (limited to 'bundles/firewall/files/etc/nftables.nft') diff --git a/bundles/firewall/files/etc/nftables.nft b/bundles/firewall/files/etc/nftables.nft new file mode 100644 index 0000000..35b10dd --- /dev/null +++ b/bundles/firewall/files/etc/nftables.nft @@ -0,0 +1,21 @@ +#!/usr/sbin/nft -f +# vim: set ts=4 sw=4: +# You can find examples in /usr/share/nftables/. + +# Clear all prior state +flush ruleset + +# Basic IPv4/IPv6 stateful firewall for server/workstation. +table inet filter { + + chain input { type filter hook input priority 0; policy drop; } + chain forward { type filter hook forward priority 0; policy drop; } + chain output { type filter hook output priority 0; policy accept; } + +} + +# The state of stateful objects saved on the nftables service stop. +include "/var/lib/nftables/*.nft" + +# Rules +include "/etc/nftables.d/*.nft" -- cgit 1.4.1