HackENS/liminix-fork
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

move nftables fib rule to the prerouting hook

Browse source
This commit is contained in:
Daniel Barlow 2023-06-27 21:23:15 +01:00
parent 6101f3f3d8
commit 78d223a839
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
examples/rotuer-firewall.nix
View file

@ -6,6 +6,8 @@ let
bogons-ip6 = {
type = "filter";
family = "ip6";
policy = "accept";
hook = "prerouting";
rules = [
(drop "ip6 saddr ff00::/8") # multicast saddr is illegal
@ -38,7 +40,6 @@ let
policy = "drop";
hook = "forward";
rules = [
"jump bogons-ip6"
(drop "ip6 saddr ::1/128") # loopback address [RFC4291]
(drop "ip6 daddr ::1/128")
(drop "ip6 saddr ::FFFF:0:0/96")# IPv4-mapped addresses
@ -101,7 +102,6 @@ let
policy = "drop";
hook = "input";
rules = [
"jump bogons-ip6"
(accept "meta l4proto icmpv6")
(if allow-incoming
then accept "oifname \"int\" iifname \"ppp0\""