dan
/
liminix
1
0
Fork 5
Code Issues 3 Pull Requests 2 Projects Releases Wiki Activity

move nftables fib rule to the prerouting hook

module-based-network
Daniel Barlow 2023-06-27 21:23:15 +01:00
parent 6101f3f3d8
commit 78d223a839
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
examples/rotuer-firewall.nix
View File

@ -6,6 +6,8 @@ let
bogons-ip6 = {
type = "filter";
family = "ip6";
policy = "accept";
hook = "prerouting";
rules = [
(drop "ip6 saddr ff00::/8") # multicast saddr is illegal
@ -38,7 +40,6 @@ let
policy = "drop";
hook = "forward";
rules = [
"jump bogons-ip6"
(drop "ip6 saddr ::1/128") # loopback address [RFC4291]
(drop "ip6 daddr ::1/128")
(drop "ip6 saddr ::FFFF:0:0/96")# IPv4-mapped addresses
@ -101,7 +102,6 @@ let
policy = "drop";
hook = "input";
rules = [
"jump bogons-ip6"
(accept "meta l4proto icmpv6")
(if allow-incoming
then accept "oifname \"int\" iifname \"ppp0\""