From 2f97417d16224ca1f79b2fe41e70b8d7ddc0ab7d Mon Sep 17 00:00:00 2001 From: sommerfeld Date: Thu, 17 Sep 2026 15:05:37 +0100 Subject: Configure LXD and AppArmor on the Arch host --- etc/nftables.conf | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'etc/nftables.conf') diff --git a/etc/nftables.conf b/etc/nftables.conf index fc2d1e7..465c9f7 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -15,6 +15,11 @@ table inet filter { meta l4proto { icmp, icmpv6 } accept comment "allow icmp" meta pkttype multicast udp dport 5353 accept comment "allow mDNS discovery" + iifname "lxdbr0" udp dport 53 accept comment "LXD DNS" + iifname "lxdbr0" tcp dport 53 accept comment "LXD DNS" + iifname "lxdbr0" meta nfproto ipv4 udp dport 67 accept comment "LXD DHCPv4" + iifname "lxdbr0" meta nfproto ipv6 udp dport 547 accept comment "LXD DHCPv6" + pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited counter } @@ -22,5 +27,8 @@ table inet filter { type filter hook forward priority filter policy drop + ct state invalid drop + iifname "lxdbr0" accept comment "allow connections from LXD instances" + oifname "lxdbr0" ct state {established, related} accept comment "allow replies to LXD instances" } } -- cgit v1.3.1