diff options
Diffstat (limited to 'extensions/libxt_tcp.txlate')
| -rw-r--r-- | extensions/libxt_tcp.txlate | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/extensions/libxt_tcp.txlate b/extensions/libxt_tcp.txlate new file mode 100644 index 00000000..db099037 --- /dev/null +++ b/extensions/libxt_tcp.txlate @@ -0,0 +1,20 @@ +iptables-translate -A INPUT -p tcp -i eth0 --sport 53 -j ACCEPT +nft add rule ip filter INPUT iifname eth0 tcp sport 53 counter accept + +iptables-translate -A OUTPUT -p tcp -o eth0 --dport 53:66 -j DROP +nft add rule ip filter OUTPUT oifname eth0 tcp dport 53-66 counter drop + +iptables-translate -I OUTPUT -p tcp -d 8.8.8.8 -j ACCEPT +nft insert rule ip filter OUTPUT ip protocol tcp ip daddr 8.8.8.8 counter accept + +iptables-translate -I OUTPUT -p tcp --dport 1020:1023 --sport 53 -j ACCEPT +nft insert rule ip filter OUTPUT tcp sport 53 tcp dport 1020-1023 counter accept + +iptables -A INPUT -p tcp --tcp-flags ACK,FIN FIN -j DROP +nft add rule ip filter INPUT tcp flags & fin|ack == fin counter drop + +iptables-translate -A INPUT -p tcp --syn -j ACCEPT +nft add rule ip filter INPUT tcp flags & (fin|syn|rst|ack) == syn counter accept + +iptables-translate -A INPUT -p tcp --syn --dport 80 -j ACCEPT +nft add rule ip filter INPUT tcp dport 80 tcp flags & (fin|syn|rst|ack) == syn counter accept |