diff options
Diffstat (limited to 'etc/nftables.conf')
| -rw-r--r-- | etc/nftables.conf | 15 |
1 files changed, 1 insertions, 14 deletions
diff --git a/etc/nftables.conf b/etc/nftables.conf index e4f68ed..355465a 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -1,8 +1,7 @@ #!/usr/bin/nft -f # vim:set ts=2 sw=2 et: -# IPv4/IPv6 Simple & Safe firewall ruleset. -# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/. +# IPv4/IPv6 default-deny firewall ruleset. destroy table inet filter table inet filter { @@ -22,12 +21,6 @@ table inet filter { iifname "virbr0" udp dport { 53, 67 } accept comment "libvirt: DHCP+DNS from guests" iifname "virbr0" tcp dport 53 accept comment "libvirt: DNS over TCP from guests" - # Waydroid's NAT bridge: same pattern as libvirt. The Android container's - # DhcpClient broadcasts DHCPDISCOVER on waydroid0; without this rule it's - # dropped before dnsmasq sees it and the container never gets an IP. - iifname "waydroid0" udp dport { 53, 67 } accept comment "waydroid: DHCP+DNS from container" - iifname "waydroid0" tcp dport 53 accept comment "waydroid: DNS over TCP from container" - pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited counter } @@ -44,11 +37,5 @@ table inet filter { # load before libvirtd has created virbr0 at boot. iifname "virbr0" accept comment "libvirt: guest egress" oifname "virbr0" ct state established,related accept comment "libvirt: guest return" - - # Waydroid's NAT bridge: same pattern as libvirt. Waydroid's container - # service installs MASQUERADE itself via iptables-nft compat, so no - # explicit nat table is needed here -- only the forward-chain accepts. - iifname "waydroid0" accept comment "waydroid: guest egress" - oifname "waydroid0" ct state established,related accept comment "waydroid: guest return" } } |