Stefan Bethke
86e793c624
The host has been manually cleaned up (removed old packages and config) and this config has been deployed already.
65 lines
2.4 KiB
Text
65 lines
2.4 KiB
Text
#!/usr/sbin/nft -f
|
|
|
|
# Docker manages its own tables (via iptables-nft), so don't use "flush ruleset" here,
|
|
# but only replace our own table. This also means that a reload is fine, but stopping
|
|
# or restarting nftables.service (which flushes the whole ruleset) requires restarting
|
|
# Docker afterwards.
|
|
# Traffic to ports published by Docker containers (web, JVB, exporter) gets DNATed in
|
|
# prerouting and therefore passes the forward hook instead of the input hook.
|
|
|
|
## Variables
|
|
|
|
define if_wan = "ens18"
|
|
|
|
# Prometheus on grafana (IPv4 via the NAT of router)
|
|
define prometheus_v4 = { 212.12.48.123 }
|
|
define prometheus_v6 = { 2a00:14b0:42:102::e }
|
|
|
|
## Rules
|
|
|
|
table inet host_filter
|
|
delete table inet host_filter
|
|
|
|
table inet host_filter {
|
|
# Runs before Docker's DNAT, so this also applies to ports published by containers.
|
|
chain prerouting {
|
|
type filter hook prerouting priority dstnat - 10; policy accept;
|
|
|
|
iifname $if_wan tcp dport 9888 ip saddr $prometheus_v4 accept comment "jitsi exporter (container)"
|
|
iifname $if_wan tcp dport 9888 ip6 saddr $prometheus_v6 accept comment "jitsi exporter (container)"
|
|
iifname $if_wan tcp dport 9888 drop
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
|
|
iifname "lo" accept
|
|
ct state invalid drop
|
|
ct state established,related accept
|
|
|
|
# ICMPv6 is needed for neighbour discovery etc.
|
|
meta l4proto ipv6-icmp accept
|
|
meta l4proto icmp accept
|
|
|
|
# Docker networks
|
|
iifname { "docker0", "br-*" } accept
|
|
|
|
tcp dport 22 accept comment "ssh"
|
|
|
|
# Ports published by containers normally get DNATed and never reach the input
|
|
# hook, but they do when handled by docker-proxy (e.g. for IPv6 without IPv6
|
|
# enabled on the Docker network).
|
|
tcp dport { 80, 443 } accept comment "jitsi web (container)"
|
|
udp dport 10000 accept comment "jitsi jvb (container)"
|
|
|
|
# coturn (runs in the host network namespace)
|
|
udp dport 3478 accept comment "turn"
|
|
tcp dport 3478 accept comment "turn"
|
|
tcp dport 5349 accept comment "turns"
|
|
udp dport 5349 accept comment "turns (dtls)"
|
|
udp dport 49152-65535 accept comment "turn relay ports"
|
|
|
|
tcp dport { 9100, 9888 } ip saddr $prometheus_v4 accept comment "node exporter, jitsi exporter (container)"
|
|
tcp dport { 9100, 9888 } ip6 saddr $prometheus_v6 accept comment "node exporter, jitsi exporter (container)"
|
|
}
|
|
}
|