14e547ce56
Separate system configuration from Dotfiles_ArchAP. Add package manifests, system inventories, reusable templates, safer backup/deployment scripts, on-demand service management, TLP and zram configuration, and updated maintenance documentation.
119 lines
3.2 KiB
Text
119 lines
3.2 KiB
Text
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet filter {
|
|
|
|
chain input {
|
|
type filter hook input priority 0;
|
|
policy drop;
|
|
|
|
meta nftrace set 1
|
|
|
|
ct state established,related accept
|
|
iif "lo" accept
|
|
|
|
# Autoriser les réponses des serveurs WireGuard vers notre client
|
|
iifname "wlp1s0" udp sport 51820 accept
|
|
|
|
# Handshakes WireGuard sur wlan0
|
|
iifname "wlp1s0" udp dport 51820 accept
|
|
iifname "wlp1s0" udp dport 51821 accept
|
|
|
|
# Proton
|
|
iifname "wg0" udp dport 53 accept
|
|
iifname "wg0" tcp dport 53 accept
|
|
iifname "wg0" tcp dport 80 accept
|
|
iifname "wg0" tcp dport 443 accept
|
|
|
|
# LAN local
|
|
iifname "wlp1s0" ip saddr 192.168.1.0/24 accept
|
|
|
|
# VMs -> dnsmasq
|
|
iifname "virbr0" udp dport { 53, 67, 68 } accept
|
|
iifname "virbr0" tcp dport 53 accept
|
|
|
|
iifname "virbr0" ct state established,related accept
|
|
iifname "virbr0" ip daddr 192.168.122.1 accept
|
|
|
|
iifname "vmnet8" tcp dport {139,445} accept
|
|
iifname "vmnet8" udp dport {137,138} accept
|
|
iifname "vmnet1" tcp dport {139,445} accept
|
|
iifname "vmnet1" udp dport {137,138} accept
|
|
|
|
meta nfproto ipv6 drop
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0;
|
|
policy drop;
|
|
|
|
# VMs -> Proton
|
|
iifname "virbr0" oifname "wg0" accept
|
|
iifname "wg0" oifname "virbr0" ct state established,related accept
|
|
|
|
# VMs -> LAN
|
|
iifname "virbr0" oifname "wlp1s0" accept
|
|
iifname "wlp1s0" oifname "virbr0" ct state established,related accept
|
|
|
|
iifname "virbr0" oifname "virbr0" accept
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority 0;
|
|
policy drop;
|
|
|
|
meta nftrace set 1
|
|
|
|
oif "lo" accept
|
|
|
|
# Autoriser ping via Proton wg0
|
|
oifname "wg0" ip protocol icmp accept
|
|
|
|
# DNS via Proton wg0
|
|
oifname "wg0" udp dport 53 accept
|
|
oifname "wg0" tcp dport 53 accept
|
|
|
|
# HTTP / HTTPS via Proton wg0 (pacman, web, etc.)
|
|
oifname "wg0" tcp dport 80 accept
|
|
oifname "wg0" tcp dport 443 accept
|
|
oifname "wg0" tcp dport 2222 accept
|
|
oifname "wg0" tcp dport 2223 accept
|
|
oifname "wg0" tcp dport { 993, 587 } accept
|
|
|
|
oifname "wg0" udp dport 123 accept
|
|
|
|
# Handshakes WG via wlan0
|
|
oifname "wlp1s0" udp dport 51820 accept
|
|
oifname "wlp1s0" udp dport 51821 accept
|
|
|
|
# sortie SSH 2222 vers le LAN
|
|
oifname "wlp1s0" ip daddr 192.168.1.0/24 tcp dport 2222 accept
|
|
oifname "wlp1s0" ip daddr 86.237.184.253 tcp dport 2222 accept
|
|
oifname "wlp1s0" ip daddr 192.168.1.0/24 tcp dport 2223 accept
|
|
oifname "wlp1s0" ip daddr 86.237.184.253 tcp dport 2223 accept
|
|
|
|
# Accès à l'interface de la box (192.168.1.1) via le LAN
|
|
oifname "wlp1s0" ip daddr 192.168.1.1 tcp dport { 80, 443, 2222, 2223} accept
|
|
oifname "wlp1s0" ip daddr 192.168.1.1 icmp type echo-request accept
|
|
oifname "wlp1s0" ip daddr 192.168.1.0/24 accept
|
|
|
|
oifname "vmnet8" accept
|
|
oifname "vmnet1" accept
|
|
|
|
# Handshakes WG qui passeraient DANS le tunnel Proton (si c'est voulu)
|
|
oifname "wg0" udp dport 51820 accept
|
|
oifname "wg0" udp dport 51821 accept
|
|
|
|
oifname "virbr0" accept
|
|
|
|
meta nfproto ipv6 drop
|
|
}
|
|
}
|
|
|
|
table ip nat {
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
ip saddr 192.168.122.0/24 oifname "wg0" masquerade
|
|
}
|
|
}
|