82 lines
3.0 KiB
YAML
82 lines
3.0 KiB
YAML
---
|
|
security_firewall_default_policy: drop
|
|
|
|
security_firewall_allowed_ports:
|
|
- "22/tcp"
|
|
- "80/tcp"
|
|
- "443/tcp"
|
|
|
|
# Interfaces that accept all traffic (loopback is always recommended)
|
|
security_nftables_trusted_interfaces:
|
|
- lo
|
|
|
|
# IPs/CIDRs that bypass all filtering
|
|
security_nftables_trusted_ips: []
|
|
# - 10.0.0.0/8
|
|
# - 192.168.1.100
|
|
|
|
# IPs/CIDRs dropped immediately on input and forward
|
|
security_nftables_blocked_ips: []
|
|
# - 203.0.113.0/24
|
|
|
|
# Extended port ranges with optional source filter
|
|
# - { start: 8000, end: 9000, proto: tcp, source: "10.0.0.0/8", comment: "internal services" }
|
|
security_nftables_allowed_port_ranges: []
|
|
|
|
security_nftables_forward_policy: accept
|
|
security_nftables_output_policy: accept
|
|
|
|
# Rate limiting
|
|
security_nftables_rate_limit_enabled: true
|
|
security_nftables_icmp_rate: "10/second"
|
|
security_nftables_new_conn_rate: "100/second"
|
|
security_nftables_new_conn_burst: 50
|
|
|
|
# Log packets that hit the default drop policy
|
|
security_nftables_log_dropped: false
|
|
security_nftables_log_prefix: "nftables-dropped: "
|
|
|
|
# Raw nftables rule strings injected into the input chain
|
|
# Each entry is a single nft rule line (without leading whitespace)
|
|
security_nftables_custom_input_rules: []
|
|
# - 'ip saddr 10.0.0.0/8 tcp dport 8080 accept comment "internal dashboard"'
|
|
|
|
# Raw nftables rule strings injected into the forward chain
|
|
security_nftables_custom_forward_rules: []
|
|
|
|
# Raw nftables rule strings injected into the output chain
|
|
security_nftables_custom_output_rules: []
|
|
|
|
# DNAT rules — port forwarding
|
|
# Optional fields: proto (default: tcp), source, iif (input interface), comment
|
|
# - { port: 8080, dest: "10.0.0.5:80", proto: "tcp", source: "0.0.0.0/0", comment: "web backend" }
|
|
# - { port: 25565, dest: "10.13.45.1:25565", proto: "tcp", iif: "enp3s0", comment: "Minecraft" }
|
|
security_nftables_dnat_rules: []
|
|
|
|
# SNAT rules — source NAT / masquerade
|
|
# All match fields are optional; combine as needed:
|
|
# source — match ip saddr (e.g. "10.0.0.0/24")
|
|
# dest — match ip daddr (e.g. "10.13.45.1")
|
|
# proto — protocol for dport/sport matching (e.g. "tcp", "udp")
|
|
# dport — match destination port (requires proto)
|
|
# sport — match source port (requires proto)
|
|
# iif — match input interface name
|
|
# oif — match output interface name
|
|
# to — SNAT target address (e.g. "100.64.0.1")
|
|
# masquerade — use masquerade instead of explicit SNAT (bool, default false)
|
|
# comment — optional rule comment
|
|
#
|
|
# Examples:
|
|
# - { source: "10.0.0.0/24", oif: "eth0", to: "203.0.113.1", comment: "outbound nat" }
|
|
# - { source: "10.0.0.0/24", oif: "eth0", masquerade: true }
|
|
# - { oif: "tailscale0", dest: "10.13.45.1", proto: "tcp", dport: "25565", to: "100.64.0.1", comment: "SNAT Minecraft via tailscale" }
|
|
security_nftables_snat_rules: []
|
|
|
|
# Interfaces to masquerade (simple outbound NAT shorthand)
|
|
security_nftables_masquerade_interfaces: []
|
|
# - eth0
|
|
|
|
# Arbitrary nftables config appended verbatim at the end of the file
|
|
# Use for anything not covered above (custom tables, chains, sets, etc.)
|
|
security_nftables_custom_config: ""
|