infrastructure/ansible/roles/ingress/files/nftables.conf
Jake Howard 53c758a781
All checks were successful
/ terraform (push) Successful in 29s
/ ansible (push) Successful in 1m38s
Monitor headscale with prometheus
2024-01-27 17:40:02 +00:00

43 lines
1.2 KiB
Text

#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0
policy drop
ct state {established, related} counter accept
iif lo accept
# Allow ICMP (pings)
ip protocol icmp accept
meta l4proto icmpv6 accept
tcp dport {http, https, {{ ssh_port }}, 8443, 8448} accept
# Allow nebula
udp dport {{ nebula_listen_port }} accept;
}
chain POSTROUTING {
type nat hook postrouting priority srcnat
policy accept
# NAT - because the proxmox machines may not have routes back
ip saddr {{ nebula.cidr }} ip daddr {{ pve_hosts.internal_cidr }} counter masquerade
}
chain FORWARD {
type filter hook forward priority mangle
policy drop
# Allow traffic from nebula to proxmox network
ip saddr {{ nebula.cidr }} ip daddr {{ pve_hosts.internal_cidr }} accept
ip saddr {{ pve_hosts.internal_cidr }} ip daddr {{ nebula.cidr }} ct state related,established accept
# Allow monitoring of nebula network
ip saddr {{ pve_hosts.forrest.ip }}/32 ip daddr {{ nebula.cidr }} accept
}
}