test-rules-min.nix (4552B)
1 let 2 drop = expr : "${expr} drop"; 3 accept = expr : "${expr} accept"; 4 mcast-scope = 8; 5 allow-incoming = false; 6 bogons-ip6 = { 7 type = "filter"; 8 family = "ip6"; 9 rules = [ 10 (drop "ip6 saddr ff00::/8") # multicast saddr is illegal 11 12 (drop "ip6 saddr ::/128") # unspecified address 13 (drop "ip6 daddr ::/128") 14 (drop "ip6 saddr 2001:db8::/32") # documentation addresses 15 (drop "ip6 daddr 2001:db8::/32") 16 17 # I think this means "check FIB for (saddr, iif) to see if we 18 # could route a packet to that address using that interface", 19 # and if we can't then it was an inapproppriate source address 20 # for packets received _from_ said interface 21 (drop "fib saddr . iif oif eq 0") 22 23 (drop "icmpv6 type router-renumbering") 24 (drop "icmpv6 type 139") # Node Information Query 25 (drop "icmpv6 type 140") # Node Information Response 26 (drop "icmpv6 type 100") 27 (drop "icmpv6 type 101") 28 (drop "icmpv6 type 200") 29 (drop "icmpv6 type 201") 30 (drop "icmpv6 type 127") 31 (drop "icmpv6 type 255") 32 (drop "icmpv6 type destination-unreachable ct state invalid,untracked") 33 ]; 34 }; 35 forward-ip6 = { 36 type = "filter"; 37 family = "ip6"; 38 policy = "drop"; 39 hook = "forward"; 40 rules = [ 41 "jump bogons-ip6" 42 (drop "ip6 saddr ::1/128") # loopback address [RFC4291] 43 (drop "ip6 daddr ::1/128") 44 (drop "ip6 saddr ::FFFF:0:0/96")# IPv4-mapped addresses 45 (drop "ip6 daddr ::FFFF:0:0/96") 46 (drop "ip6 saddr fe80::/10") # link-local unicast 47 (drop "ip6 daddr fe80::/10") 48 (drop "ip6 saddr fc00::/7") # unique-local addresses 49 (drop "ip6 daddr fc00::/7") 50 (drop "ip6 saddr 2001:10::/28") # ORCHID [RFC4843]. 51 (drop "ip6 daddr 2001:10::/28") 52 53 (drop "ip6 saddr fc00::/7") # unique local source 54 (drop "ip6 daddr fc00::/7") # and/or dst addresses [RFC4193] 55 56 # multicast with wrong scopes 57 (drop 58 # dest addr first byte 0xff, low nibble of second byte <= scope 59 # https://www.mankier.com/8/nft#Payload_Expressions-Raw_Payload_Expression 60 "@nh,192,8 eq 0xff @nh,204,4 le ${toString mcast-scope}") 61 62 (accept "oifname \"int\" iifname \"ppp0\" meta l4proto udp ct state established,related") 63 (accept "iifname \"int\" oifname \"ppp0\" meta l4proto udp") 64 65 (accept "meta l4proto icmpv6") 66 (accept "meta l4proto ah") 67 (accept "meta l4proto esp") 68 69 # does this ever get used or does the preceding general udp accept 70 # already grab anything that might get here? 71 (accept "oifname \"ppp0\" udp dport 500") # IKE Protocol [RFC5996]. haha zyxel 72 (accept "ip6 nexthdr hip") 73 74 ## FIXME no support yet for recs 27-30 Mobility Header 75 76 (accept "oifname \"int\" iifname \"ppp0\" meta l4proto tcp ct state established,related") 77 (accept "iifname \"int\" oifname \"ppp0\" meta l4proto tcp") 78 79 (accept "oifname \"int\" iifname \"ppp0\" meta l4proto sctp ct state established,related") 80 (accept "iifname \"int\" oifname \"ppp0\" meta l4proto sctp") 81 82 (accept "oifname \"int\" iifname \"ppp0\" meta l4proto dccp ct state established,related") 83 (accept "iifname \"int\" oifname \"ppp0\" meta l4proto dccp") 84 85 # we can allow all reasonable inbound, or we can use an explicit 86 # allowlist to enumerate the endpoints that are allowed to 87 # accept inbound from the WAN 88 (if allow-incoming 89 then accept "oifname \"int\" iifname \"ppp0\"" 90 else "oifname \"int\" iifname \"ppp0\" jump incoming-allowed-ip6" 91 ) 92 # allow all outbound and any inbound that's part of a 93 # recognised (outbound-initiated) flow 94 (accept "oifname \"int\" iifname \"ppp0\" ct state established,related") 95 (accept "iifname \"int\" oifname \"ppp0\" ") 96 ]; 97 }; 98 input-ip6 = { 99 type = "filter"; 100 family = "ip6"; 101 policy = "drop"; 102 hook = "input"; 103 rules = [ 104 "jump bogons-ip6" 105 (accept "meta l4proto icmpv6") 106 (if allow-incoming 107 then accept "oifname \"int\" iifname \"ppp0\"" 108 else "oifname \"int\" iifname \"ppp0\" jump incoming-allowed-ip6" 109 ) 110 (accept "oifname \"int\" iifname \"ppp0\" ct state established,related") 111 (accept "iifname \"int\" oifname \"ppp0\" ") 112 ]; 113 }; 114 115 incoming-allowed-ip6 = { 116 type = "filter"; 117 family = "ip6"; 118 rules = [ 119 "oifname \"int\" ip6 daddr 2001:8b0:de3a:40de::e9d tcp dport 22" 120 ]; 121 }; 122 in { 123 inherit input-ip6 forward-ip6 bogons-ip6 incoming-allowed-ip6; 124 }