33 lines
732 B
Django/Jinja
33 lines
732 B
Django/Jinja
#!/usr/sbin/nft -f
|
|
# {{ ansible_managed }}
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0;
|
|
|
|
# accept any localhost traffic
|
|
iif lo accept
|
|
|
|
# accept traffic originated from us
|
|
ct state established,related accept
|
|
|
|
# accept neighbour discovery otherwise IPv6 connectivity breaks.
|
|
ip6 nexthdr icmpv6 icmpv6 type {nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert} accept
|
|
|
|
{% if nftables_rules | length > 0 %}
|
|
# include specific rules
|
|
include "/srv/nftables/rules.conf"
|
|
{% endif %}
|
|
|
|
# count and drop any other traffic
|
|
counter drop
|
|
}
|
|
}
|
|
|
|
{% if nftables_tables | length > 0 %}
|
|
# include more tables
|
|
include "/srv/nftables/tables.conf"
|
|
{% endif %}
|