infrastructure/ansible/roles/ingress/files/nftables.conf

45 lines
1.1 KiB
Text
Raw Permalink Normal View History

#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0
policy drop
ct state {established, related} counter accept
iif lo accept
# Allow ICMP (pings)
ip protocol icmp accept
meta l4proto icmpv6 accept
tcp dport {http, https, {{ ssh_port }}, 8443, 8448} accept
2023-11-03 18:06:36 +00:00
# Allow Tailscale
udp dport {{ tailscale_port }} accept;
}
chain POSTROUTING {
type nat hook postrouting priority srcnat
policy accept
# NAT - because the proxmox machines may not have routes back
ip saddr {{ tailscale_cidr }} counter masquerade
}
chain FORWARD {
type filter hook forward priority mangle
policy drop
# Allow monitoring of Tailscale network
ip saddr {{ pve_hosts.forrest.ip }}/32 ip daddr {{ tailscale_cidr }} accept
# Allow Tailscale exit node
ip saddr {{ tailscale_cidr }} ip daddr 192.168.0.0/16 drop
ip saddr {{ tailscale_cidr }} accept
ip daddr {{ tailscale_cidr }} ct state related,established accept
}
}