diff --git a/base/etc/nftables/main.nft b/base/etc/nftables/main.nft index cb2c021..be57b42 100644 --- a/base/etc/nftables/main.nft +++ b/base/etc/nftables/main.nft @@ -10,26 +10,19 @@ table filter { iif lo accept comment "Accept any localhost traffic"; ct state invalid drop comment "Drop invalid connections"; ct state established,related accept comment "Accept traffic originated from us"; - ip protocol igmp accept comment "Accept IGMP" + # ip protocol igmp accept comment "Accept IGMP" icmp type echo-request accept; tcp dport 22 accept comment "Accept SSH on port 22"; - ip saddr 192.168.33.0/24 accept; - tcp dport 53 accept; - udp dport 53 accept; - udp dport 69 accept comment "Accept TFTP on port 69"; + # ip saddr 192.168.0.0/24 accept; tcp dport 80 accept comment "Accept HTTP on port 80"; tcp dport 443 accept comment "Accept HTTPS on port 443"; - tcp dport { 2379, 2380 } accept comment "Accept etcd on port 2379, 2380"; tcp dport 3128 accept comment "Accept Proxy on port 3128"; - tcp dport 3129 accept comment "Accept Proxy on port 3129"; tcp dport 2375 accept comment "Accept Docker on port 2375"; tcp dport 5000 accept comment "Accept Python App on port 5000"; tcp dport 5432 accept comment "Accept PostgreSQL on port 5432"; - tcp dport 8301 accept comment "Accept Consul on port 8301"; - tcp dport 9001 accept comment "Accept Supervisor on port 9001"; ip saddr 172.16.0.0/12 ip daddr 10.2.0.0/16 accept; - ip saddr 178.252.218.67 tcp dport 10050 accept comment "Accept Zabbix on port 10050"; + # ip saddr EXTERNALIP tcp dport 10050 accept comment "Accept Zabbix on port 10050"; } chain forward {