INPUT

Посмотреть

nft list ruleset

Создаем таблицу filter

nft add table inet filter

Создаем цепочку input

nft add chain inet filter input {type filter hook input priority 0\;}

Базовая часть правил безопасности для TCP-соединений

nft 'add rule inet filter input tcp flags != syn / fin,syn,rst,ack ct state new counter drop'

nft 'add rule inet filter input tcp flags fin,syn,rst,psh,ack,urg / fin,syn,rst,psh,ack,urg counter drop'

nft 'add rule inet filter input tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 counter drop'

Invalid + related,established + lo

nft 'add rule inet filter input ct state invalid counter drop'

nft 'add rule inet filter input ct state related,established counter accept'

nft 'add rule inet filter input iifname "lo" counter accept '

Разрешить все с доверенных IP

nft add rule inet filter input ip saddr {178.150.69.156, 193.123.36.107, 172.16.2.0/24} accept

Разрешить все с доверенных IP по определенным портам (SSH + 8006)

nft 'add rule inet filter input ip saddr {10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, mlp.pp.ua } tcp dport {22, 8006} counter accept'

Задать политику

nft chain inet filter input {policy drop \;}

icmp

nft 'add rule inet filter input ip protocol icmp counter accept'

ipv6

nft add rule inet filter input ip6 saddr 178.150.69.156 ip6 nexthdr icmpv6 accept

Если с доверенного адреса

nft add rule inet filter input ip saddr 178.150.69.156 ip protocol icmp accept

Если с доверенных адресов

nft add rule inet filter input ip saddr {178.150.69.156, 193.123.36.107} ip protocol icmp accept

WEB

nft 'add rule inet filter input tcp dport {80, 443} counter accept'

Zabbix

nft add rule inet filter input ip saddr 193.123.36.107/32 tcp dport 10050 counter accept

Пример файла

table inet filter {
        chain input {
                type filter hook input priority filter; policy drop;
                tcp flags != syn / fin,syn,rst,ack ct state new counter drop
                tcp flags fin,syn,rst,psh,ack,urg / fin,syn,rst,psh,ack,urg counter drop
                tcp flags ! fin,syn,rst,psh,ack,urg counter drop
                ct state invalid counter drop
                ct state established,related counter accept
                iifname "lo" counter accept
                ip saddr { 10.0.0.0/8, 172.16.0.0/12, 178.150.69.156, 192.168.0.0/16, 193.123.36.107 } tcp dport { 22, 8006 } counter accept
                ip saddr 178.150.69.156 ip protocol icmp accept
        }

        chain forward {
                type filter hook forward priority filter; policy accept;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}