|
|
楼主 |
发表于 2022-12-27 16:22
|
显示全部楼层
看到一篇很好的nftables hardening的文章，做了一些修改，除了ipv6的hardening规则还需完善外，基本算完工了。
https://blog.samuel.domains/blog/security/nftables-hardening-rules-and-good-practices
- flush ruleset
- define DEV_LAN = eth1
- define DEV_WAN = ppp0
- define DEV_MODEM = eth0
- define IP_MODEM = 192.168.0.11
- define IPTV_VLAN85 = eth0.85
- define IPTV_VLAN51 = eth0.51
- define GUEST_LAN = 192.168.4.0/24
- define IOT_LAN = 192.168.5.0/24
- define HOME_LAN = 192.168.10.0/24
- define LAN_SET = {
- $GUEST_LAN,
- $IOT_LAN,
- $HOME_LAN
- }
- table netdev filter {
- chain ingress {
- type filter hook ingress device $DEV_WAN priority -500;
- # IP FRAGMENTS
- ip frag-off & 0x1fff != 0 counter drop
- # IP BOGONS
- # From <https://www.team-cymru.com/bogon-reference.html>.
- ip saddr {
- 0.0.0.0/8,
- 10.0.0.0/8,
- 100.64.0.0/10,
- 127.0.0.0/8,
- 169.254.0.0/16,
- 172.16.0.0/12,
- 192.0.0.0/24,
- 192.0.2.0/24,
- 192.168.0.0/16,
- 198.18.0.0/15,
- 198.51.100.0/24,
- 203.0.113.0/24,
- 224.0.0.0/3
- } counter drop
- # TCP XMAS
- tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg counter drop
- # TCP NULL
- tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop
- # TCP MSS
- tcp flags syn tcp option maxseg size 1-536 counter drop
- }
- }
- table inet global {
- flowtable f {
- hook ingress priority 0; devices = { $DEV_LAN, $DEV_MODEM };
- }
- chain inbound_wan {
- # Allow-ping-from-WAN
- icmp type { echo-reply, echo-request } limit rate 10/second burst 20 packets counter accept
- # Accept basic IPv6 functionality
- ip6 nexthdr icmpv6 icmpv6 type {
- destination-unreachable, # type 1
- packet-too-big, # type 2
- time-exceeded, # type 3
- parameter-problem, # type 4
- echo-request, # type 128
- echo-reply, # type 129
- } limit rate 10/second burst 20 packets counter accept
- }
- chain inbound_lan {
- icmp type { echo-reply, echo-request } accept
- ip6 nexthdr icmpv6 icmpv6 type {
- destination-unreachable, # type 1
- packet-too-big, # type 2
- time-exceeded, # type 3
- parameter-problem, # type 4
- echo-request, # type 128
- echo-reply, # type 129
- } accept
- # allow DNS, NTP and SSH from the private network
- meta l4proto . th dport vmap { udp . 53 : accept, tcp . 53 : accept, udp . 123 : accept }
- ip saddr $HOME_LAN tcp dport 22 accept
- }
- chain inbound {
- type filter hook input priority 0; policy drop;
- # Allow traffic from established and related packets, drop invalid
- ct state vmap { established : accept, related : accept, invalid : drop }
- # Allow IPv6 SLAAC
- ip6 nexthdr icmpv6 icmpv6 type {
- nd-router-solicit, # type 133
- nd-router-advert, # type 134
- nd-neighbor-solicit, # type 135
- nd-neighbor-advert, # type 136
- } ip6 hoplimit 255 counter accept
- # Allow IPv6 multicast listener discovery on link-local
- ip6 nexthdr icmpv6 icmpv6 type {
- mld-listener-query, # type 130
- mld-listener-report, # type 131
- mld-listener-reduction, # type 132
- mld2-listener-report, # type 143
- } ip6 saddr fe80::/10 counter accept
- # Accept DHCPv6 replies from IPv6 link-local addresses
- meta nfproto ipv6 udp sport 547 udp dport 546 counter accept
- # allow loopback traffic, anything else jump to chain for further evaluation
- iifname vmap { lo : accept, $DEV_WAN : jump inbound_wan, $DEV_LAN : jump inbound_lan }
- # the rest will be dropped
- }
- chain outbound {
- type filter hook output priority 0; policy accept;
- }
- chain forward {
- type filter hook forward priority 0; policy drop;
- meta l4proto { tcp, udp } flow offload @f
- counter
- # Allow traffic from established and related packets, drop invalid
- ct state vmap { established : accept, related : accept, invalid : drop }
- # Accept basic IPv6 functionality
- iifname $DEV_WAN ip6 nexthdr icmpv6 icmpv6 type {
- destination-unreachable, # type 1
- packet-too-big, # type 2
- time-exceeded, # type 3
- parameter-problem, # type 4
- echo-request, # type 128
- echo-reply, # type 129
- } limit rate 10/second burst 20 packets counter accept
- # internal nets are allowed
- iifname $DEV_LAN counter accept
- # connections from the internet to the home lan
- iifname $DEV_WAN ip daddr $HOME_LAN ct status dnat counter accept
- # the rest will be dropped
- }
- chain forward_mangle {
- type filter hook forward priority mangle; policy accept;
- # IPV4 TCP MSS Clamping
- oifname $DEV_WAN meta nfproto ipv4 tcp flags syn tcp option maxseg size set 1452
- # IPV6 TCP MSS Clamping
- oifname $DEV_WAN meta nfproto ipv6 tcp flags syn tcp option maxseg size set 1432
- }
- chain prerouting {
- type filter hook prerouting priority -150; policy accept;
- # CT INVALID
- ct state invalid counter drop
- # TCP SYN (CT NEW)
- tcp flags & (fin|syn|rst|ack) != syn ct state new counter drop
- }
- }
- table ip nat {
- chain nat_prerouting {
- type nat hook prerouting priority -100; policy accept;
- # port forwarding: PVE, HomeAssistant, qbittorrent & WireGuard
- iifname $DEV_WAN ip protocol { tcp, udp } th dport 53847 dnat to 192.168.10.4
- iifname $DEV_WAN dnat to tcp dport map { 8006 : 192.168.10.250, 8123 : 192.168.10.252 }
- iifname $DEV_WAN udp dport 13231 dnat to 192.168.10.251
- }
- chain nat_postrouting {
- type nat hook postrouting priority 100; policy accept;
- # masquerade private IP addresses
- ip saddr $LAN_SET oifname $DEV_WAN masquerade
- # allow access from home LAN to Modem
- ip saddr $HOME_LAN oifname $DEV_MODEM snat to $IP_MODEM
- }
- }
- table bridge iptv {
- chain port_block {
- type filter hook forward priority 0; policy accept;
- # drop IPTV packages between VLAN85 & VLAN51
- iif $IPTV_VLAN85 oif $IPTV_VLAN51 counter drop
- iif $IPTV_VLAN51 oif $IPTV_VLAN85 counter drop
- }
- }
|
|
310112100042806
发表于 2022-12-24 15:06
作用是比较小咯，主要是对路由器的DDoS的一个防御
