Firewall - Revision history

Brendan: added l4proto and ipv6-icmp

2025-02-21T10:48:49Z

added l4proto and ipv6-icmp

← Older revision		Revision as of 10:48, 21 February 2025
Line 83:		Line 83:
	# routers may also want: mld-listener-query, nd-router-solicit		# routers may also want: mld-listener-query, nd-router-solicit
	icmpv6 type { echo-request, nd-neighbor-solicit } accept		icmpv6 type { echo-request, nd-neighbor-solicit } accept
			meta l4proto ipv6-icmp accept

	# open tcp ports: sshd (22), httpd (80)		# open tcp ports: sshd (22), httpd (80)

2025-02-18T17:55:21Z

iptables oneliners

← Older revision		Revision as of 17:55, 18 February 2025
Line 19:		Line 19:

	== <code>iptables</code> oneliners ==		== <code>iptables</code> oneliners ==
			note - for newer setups see nftables below. iptables commands still work but directly using nftables is preferred.

	* list all rules from all chains		* list all rules from all chains
	iptables -L		iptables -L
Line 24:		Line 26:
	iptables -I INPUT -s 192.168.111.111 -j DROP		iptables -I INPUT -s 192.168.111.111 -j DROP
	iptables -I OUTPUT -d 192.168.111.111 -j DROP		iptables -I OUTPUT -d 192.168.111.111 -j DROP


	== nftables ==		== nftables ==

2025-02-18T17:53:58Z

add interface and ports to help tinc

← Older revision		Revision as of 17:53, 18 February 2025
Line 48:		Line 48:
	# loopback interface		# loopback interface
	iifname lo accept		iifname lo accept

			# open vpn traffic
			iifname lurknet accept

	# icmp		# icmp
Line 53:		Line 56:

	# open tcp ports: sshd (22), httpd (80)		# open tcp ports: sshd (22), httpd (80)
	tcp dport { ssh, http, https, 999 } accept		tcp dport { ssh, http, https, 655, 999 } accept

	# tinc		# tinc
	udp dport { 60000-61000 } accept		udp dport { 655, 60000-61000 } accept
	}		}
	}		}
Line 72:		Line 75:
	# loopback interface		# loopback interface
	iifname lo accept		iifname lo accept

			# vpn interface
			iifname lurknet accept

	# icmp		# icmp
Line 78:		Line 84:

	# open tcp ports: sshd (22), httpd (80)		# open tcp ports: sshd (22), httpd (80)
	tcp dport { ssh, http, https, 999 } accept		tcp dport { ssh, http, https, 655, 999 } accept

	# tinc		# tinc
	udp dport { 60000-61000 } accept		udp dport { 655, 60000-61000 } accept
	}		}
	}		}

2025-02-18T12:40:58Z

← Older revision		Revision as of 12:40, 18 February 2025
Line 85:		Line 85:
	}		}
	</pre>		</pre>


	* start the firewall		* start the firewall
	systemctl start nftables		systemctl start nftables

	* see how it looks (assuming you have not just accidentally locked yourself out of the server)		* see how it looks (assuming you have not just accidentally locked yourself out of the server)
	nft list ruleset		nft list ruleset

	get rich off your NFT!		get rich off your NFT!

	[[Category:System]]		[[Category:System]]

2025-02-18T12:40:02Z

aha. need to use PRE tags for code blocks (and ascii art I suppose)

← Older revision		Revision as of 12:40, 18 February 2025
Line 34:		Line 34:

	* a basic firewall config you can drop into /etc/nftables.conf		* a basic firewall config you can drop into /etc/nftables.conf
	~~{{Codesample \|~~		<pre>
	#!/usr/sbin/nft -f		#!/usr/sbin/nft -f

Line 84:		Line 84:
	}		}
	}		}
	}}		</pre>

	* start the firewall		* start the firewall

2025-02-18T12:36:58Z

← Older revision		Revision as of 12:36, 18 February 2025
Line 34:		Line 34:

	* a basic firewall config you can drop into /etc/nftables.conf		* a basic firewall config you can drop into /etc/nftables.conf
	{{~~code~~ \|		{{Codesample \|
	#!/usr/sbin/nft -f		#!/usr/sbin/nft -f

2025-02-18T12:35:32Z

← Older revision		Revision as of 12:35, 18 February 2025
Line 34:		Line 34:

	* a basic firewall config you can drop into /etc/nftables.conf		* a basic firewall config you can drop into /etc/nftables.conf
	<code>		{{code \|
	#!/usr/sbin/nft -f		#!/usr/sbin/nft -f

Line 84:		Line 84:
	}		}
	}		}
	~~</code>~~		}}

	* start the firewall		* start the firewall

2025-02-18T12:30:23Z

add docs for nftables firewall

@@ Line 1: / Line 1: @@
-Different ways to handle <code>iptables</code>.
+Different ways to handle <code>iptables</code> and <code>nftables</code>.
 == Using <code>iptables-persistent</code> on Debian ==
@@ Line 25: / Line 25: @@
   iptables -I OUTPUT -d 192.168.111.111 -j DROP
 [[Category:System]]

2024-05-02T22:14:50Z

iptables oneliners

← Older revision		Revision as of 22:14, 2 May 2024
Line 21:		Line 21:
	* list all rules from all chains		* list all rules from all chains
	iptables -L		iptables -L
			* block an IP
			iptables -I INPUT -s 192.168.111.111 -j DROP
			iptables -I OUTPUT -d 192.168.111.111 -j DROP


	[[Category:System]]		[[Category:System]]

2019-12-16T16:08:29Z