blob: 07ebb2a2b26a05ffb1cbf37590e3eab499ba07ca (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
|
#!/usr/sbin/nft -f
# This example file shows how to use ct helpers in the nftables framework.
# Note that nftables includes interesting improvements compared to how this
# was done with iptables, such as loading multiple helpers with a single rule
# This script is meant to be loaded with `nft -f <file>`
# You require linux kernel >= 4.12 and nft >= 0.8
# For up-to-date information please visit https://wiki.nftables.org
# Using ct helpers is an important security feature when doing stateful
# firewalling, since it mitigate certain networking attacks.
# More info at: https://home.regit.org/netfilter-en/secure-use-of-helpers/
flush ruleset
table inet filter {
# declare helpers of this table
ct helper ftp-standard {
type "ftp" protocol tcp;
l3proto inet
}
ct helper sip-5060 {
type "sip" protocol udp;
l3proto inet
}
ct helper tftp-69 {
type "tftp" protocol udp
l3proto inet
}
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
# assign a single helper in a single rule
tcp dport 21 ct helper set "ftp-standard"
# assign multiple helpers in a single rule
ct helper set udp dport map {
69 : "tftp-69", \
5060 : "sip-5060" }
}
}
|
