nft list ruleset
table inet proxmox-firewall {
set v4-dc/management {
type ipv4_addr
flags interval
auto-merge
}
set v4-dc/management-nomatch {
type ipv4_addr
flags interval
auto-merge
}
set v6-dc/management {
type ipv6_addr
flags interval
auto-merge
}
set v6-dc/management-nomatch {
type ipv6_addr
flags interval
auto-merge
}
set v4-synflood-limit {
type ipv4_addr
flags dynamic,timeout
timeout 1m
}
set v6-synflood-limit {
type ipv6_addr
flags dynamic,timeout
timeout 1m
}
map bridge-map {
type ifname : verdict
}
chain do-reject {
meta pkttype broadcast drop
ip saddr 224.0.0.0/4 drop
meta l4proto tcp reject with tcp reset
meta l4proto { icmp, ipv6-icmp } reject
reject with icmp host-prohibited
reject with icmpv6 admin-prohibited
drop
}
chain accept-management {
ip saddr @v4-dc/management ip saddr != @v4-dc/management-nomatch accept
ip6 saddr @v6-dc/management ip6 saddr != @v6-dc/management-nomatch accept
}
chain block-synflood {
tcp flags & (fin | syn | rst | ack) != syn return
jump ratelimit-synflood
drop
}
chain log-drop-invalid-tcp {
jump log-invalid-tcp
drop
}
chain block-invalid-tcp {
tcp flags & (fin | syn | rst | psh | ack | urg) == fin | psh | urg goto log-drop-invalid-tcp
tcp flags ! fin,syn,rst,psh,ack,urg goto log-drop-invalid-tcp
tcp flags & (syn | rst) == syn | rst goto log-drop-invalid-tcp
tcp flags & (fin | syn) == fin | syn goto log-drop-invalid-tcp
tcp sport 0 tcp flags & (fin | syn | rst | ack) == syn goto log-drop-invalid-tcp
}
chain allow-ndp-in {
icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } accept
}
chain block-ndp-in {
icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } drop
}
chain allow-ndp-out {
icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } accept
}
chain block-ndp-out {
icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } drop
}
chain block-smurfs {
ip saddr 0.0.0.0 return
meta pkttype broadcast goto log-drop-smurfs
ip saddr 224.0.0.0/4 goto log-drop-smurfs
}
chain allow-icmp {
icmp type { destination-unreachable, source-quench, time-exceeded } accept
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
}
chain log-drop-smurfs {
jump log-smurfs
drop
}
chain default-in {
iifname "lo" accept
jump allow-icmp
ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
meta l4proto igmp accept
tcp dport { 22, 3128, 5900-5999, 8006 } jump accept-management
udp dport 5405-5412 accept
udp dport { 135, 137-139, 445 } goto do-reject
udp sport 137 udp dport 1024-65535 goto do-reject
tcp dport { 135, 139, 445 } goto do-reject
udp dport 1900 drop
udp sport 53 drop
}
chain default-out {
oifname "lo" accept
jump allow-icmp
ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
}
chain before-bridge {
meta protocol arp accept
meta protocol != arp ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
}
chain host-bridge-input {
type filter hook input priority filter - 1; policy accept;
iifname vmap @bridge-map
}
chain host-bridge-output {
type filter hook output priority filter + 1; policy accept;
oifname vmap @bridge-map
}
chain input {
type filter hook input priority filter; policy accept;
jump default-in
jump ct-in
jump option-in
jump host-in
jump cluster-in
}
chain output {
type filter hook output priority filter; policy accept;
jump default-out
jump option-out
jump host-out
jump cluster-out
}
chain forward {
type filter hook forward priority filter; policy accept;
jump host-forward
jump cluster-forward
}
chain ratelimit-synflood {
}
chain log-invalid-tcp {
}
chain log-smurfs {
}
chain option-in {
}
chain option-out {
}
chain cluster-in {
}
chain cluster-out {
}
chain host-in {
}
chain host-out {
}
chain cluster-forward {
}
chain host-forward {
meta protocol != arp ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
meta protocol != arp ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
[...]
meta protocol != arp ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
}
chain ct-in {
}
chain invalid-conntrack {
}
}
table bridge proxmox-firewall-guests {
map vm-map-in {
typeof oifname : verdict
}
map vm-map-out {
typeof iifname : verdict
}
map bridge-map {
type ifname . ifname : verdict
}
chain allow-dhcp-in {
udp sport . udp dport { 547 . 546, 67 . 68 } accept
}
chain allow-dhcp-out {
udp sport . udp dport { 546 . 547, 68 . 67 } accept
}
chain block-dhcp-in {
udp sport . udp dport { 547 . 546, 67 . 68 } drop
}
chain block-dhcp-out {
udp sport . udp dport { 546 . 547, 68 . 67 } drop
}
chain allow-ndp-in {
icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } accept
}
chain block-ndp-in {
icmpv6 type { nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect } drop
}
chain allow-ndp-out {
icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } accept
}
chain block-ndp-out {
icmpv6 type { nd-router-solicit, nd-neighbor-solicit, nd-neighbor-advert } drop
}
chain allow-ra-out {
icmpv6 type { nd-router-advert, nd-redirect } accept
}
chain block-ra-out {
icmpv6 type { nd-router-advert, nd-redirect } drop
}
chain allow-icmp {
icmp type { destination-unreachable, source-quench, time-exceeded } accept
icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem } accept
}
chain do-reject {
meta pkttype broadcast drop
ip saddr 224.0.0.0/4 drop
meta l4proto tcp reject with tcp reset
meta l4proto { icmp, ipv6-icmp } reject
reject with icmp host-prohibited
reject with icmpv6 admin-prohibited
drop
}
chain pre-vm-out {
meta protocol != arp ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
}
chain vm-out {
type filter hook prerouting priority 0; policy accept;
jump allow-icmp
iifname vmap @vm-map-out
}
chain pre-vm-in {
meta protocol != arp ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
meta protocol arp accept
}
chain vm-in {
type filter hook postrouting priority 0; policy accept;
jump allow-icmp
oifname vmap @vm-map-in
}
chain before-bridge {
meta protocol arp accept
meta protocol != arp ct state vmap { invalid : jump invalid-conntrack, established : accept, related : accept }
}
chain forward {
type filter hook forward priority 0; policy accept;
meta ibrname . meta obrname vmap @bridge-map
}
chain invalid-conntrack {
}
}
