sophia/ansible-infra
0
0
Fork 0
forked from CCCHH/ansible-infra
Code Pull requests Activity

z9-router(host): remove netwan, vlan55 untagged, add and fix DNS, fix formatting

Browse source
This commit is contained in:
bitwhisker 2026-08-07 22:32:58 +02:00
commit 51b2cac907
Signed by: bitwhisker
SSH key fingerprint: SHA256:KybIk/tusSKao6eLGY+ILlFa1rCrzwx66/acBAcKUqE
8 changed files with 22 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

15
resources/z9/z9-router/nftables/nftables.conf
View file

@ -1,4 +1,5 @@
#!/usr/sbin/nft -f
flush ruleset
## Variables
@ -6,9 +7,8 @@
# Interfaces
#define if_netwan = "netwan"
define if_netlan = "netlan"
define if_wg56_management = "wg56"
define if_wg56_management = "wg56"
define if_netwan_400_fux_uplink = "netwan.400"
define if_netlan_51_clients = "netlan.51"
define if_netlan_52_iot = "netlan.52"
@ -29,7 +29,6 @@ define v4_nat_ifs = { $if_netlan_51_clients,
## Rules
table inet reverse-path-forwarding {
chain rpf-filter {
type filter hook prerouting priority mangle + 10; policy drop;
@ -49,7 +48,7 @@ table inet host {
ct state invalid drop
ct state established,related accept
ip protocol icmp accept
ip protocol icmp accept
# ICMPv6
# https://datatracker.ietf.org/doc/html/rfc4890#autoid-24
# Allowlist consisting of: "Traffic That Must Not Be Dropped" and "Traffic That Normally Should Not Be Dropped"
@ -79,7 +78,7 @@ table inet host {
iifname { $lan_ifs } udp dport 547 accept comment "allow dhcpv6 server access"
# Allow DNS server access from lan_ifs
iifname { $lan_ifs, $if_wg56_management } udp dport 53 accept comment "allow dns server access from lan_ifs"
iifname { $lan_ifs, $if_wg56_management } meta l4proto { tcp, udp } dport 53 accept comment "allow dns server access from lan_ifs"
}
}
@ -103,7 +102,7 @@ table inet forward {
ct state established,related accept
# Allow internet access.
iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"
iifname { $lan_ifs, $if_wg56_management } oifname $wan_ifs accept comment "allow internet access"
# Allow access to exposed networks from internet.
meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
@ -111,5 +110,9 @@ table inet forward {
# Allow clients and management to most
iifname { $if_netlan_51_clients, $if_netlan_55_management, $if_wg56_management } oifname $lan_ifs accept comment "Allow clients and management to lan interfaces"
# Fux PVE backups
ip6 saddr { 2a07:c481:0:1::/64 } ip6 daddr { 2a07:c481:1:36::15/128 } accept comment "allow Fux PVE to access CCCHH PBS"
}
}