grate/grate.nft at main · DataLabTechTV/grate · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
add table inet grate;
flush table inet grate;

include "./workspace/vars.nft"

table inet grate {
    chain input {
        type filter hook input priority filter + 50; policy accept

        iifname @podman_iface meta nfproto ipv6 drop
        ct state { established, related } accept
        iifname @podman_iface ip protocol icmp drop

        iifname @podman_iface drop
    }

    chain forward {
        type filter hook forward priority filter + 50; policy accept

        iifname @podman_iface meta nfproto ipv6 drop
        oifname @podman_iface meta nfproto ipv6 drop

        ct state { established, related } accept

        iifname @podman_iface oifname != @podman_iface ip daddr {
            10.0.0.0/8,
            172.16.0.0/12,
            192.168.0.0/16,
            169.254.0.0/16
        } drop

        iifname @podman_iface oifname != @podman_iface ip protocol icmp icmp type { echo-request, echo-reply } accept

        # Applies to base containers, for them to connect to the DNS container
        oifname @podman_iface ip daddr @dns_server udp dport 53 accept
        oifname @podman_iface ip daddr @dns_server tcp dport 53 accept

        # Applies to DNS container, for it to proxy requests to the outside
        iifname @podman_iface ip saddr @dns_server udp dport 53 accept
        iifname @podman_iface ip saddr @dns_server tcp dport 53 accept

        # iifname @podman_iface oifname != @podman_iface tcp dport { 80, 443 } accept

        iifname @podman_iface drop
        oifname @podman_iface drop
    }

    chain output {
        type filter hook output priority filter + 50; policy accept

        oifname @podman_iface meta nfproto ipv6 drop
        ct state { established, related } accept
        oifname @podman_iface ip protocol icmp drop

        oifname @podman_iface drop
    }
}