infrastructure/ansible/roles/ingress/files/nftables.conf
Jake Howard 5fb605231d
All checks were successful
/ terraform (push) Successful in 33s
/ ansible (push) Successful in 1m50s
Allow pings to ingress
This makes testing connections much simpler
2023-11-05 21:48:25 +00:00

40 lines
1 KiB
Text

#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0
policy drop
ct state {established, related} counter accept
iif lo accept
# Allow ICMP (pings)
ip protocol icmp accept
meta l4proto icmpv6 accept
tcp dport {http, https, {{ ssh_port }}, 8443, 8448} accept
# Allow nebula
udp dport {{ nebula_listen_port }} accept;
}
chain POSTROUTING {
type nat hook postrouting priority srcnat
policy accept
# NAT - because the proxmox machines may not have routes back
ip saddr {{ nebula.cidr }} ip daddr {{ pve_hosts.internal_cidr }} counter masquerade
}
chain FORWARD {
type filter hook forward priority mangle
policy drop
# Allow traffic from nebula to proxmox network
ip saddr {{ nebula.cidr }} ip daddr {{ pve_hosts.internal_cidr }} accept
ip saddr {{ pve_hosts.internal_cidr }} ip daddr {{ nebula.cidr }} ct state related,established accept
}
}