diff options
Diffstat (limited to 'roles/space_server/files/nftables')
| -rw-r--r-- | roles/space_server/files/nftables/nftables.conf | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/roles/space_server/files/nftables/nftables.conf b/roles/space_server/files/nftables/nftables.conf index 30233b0..f038d60 100644 --- a/roles/space_server/files/nftables/nftables.conf +++ b/roles/space_server/files/nftables/nftables.conf @@ -102,15 +102,15 @@ table ip filter { ct state established,related accept ct state invalid drop + # accept all traffic to spacewand + ip daddr $spacewand4 accept + ip saddr $labitat udp dport 161 counter accept # traffic stats # no traffic to admin net ip daddr $adm_net4 ip saddr $int_net4 reject with icmp type net-prohibited ip daddr $adm_net4 drop - # accept all traffic to spacewand - ip daddr $spacewand4 accept - # local traffic iif $adm_if ip saddr $adm_net4 accept iif $wire_if ip saddr $wire_net4 accept @@ -163,11 +163,12 @@ table ip6 filter { ct state established,related accept ct state invalid drop + # accept all traffic to spacewand ip6 daddr $spacewand6 accept iif $wire_if ip6 saddr $wire_net6 accept iif $priv_if ip6 saddr $priv_net6 accept - #iif $free_if ip6 saddr $free_net6 ip6 daddr != $int_net6 accept + iif $free_if ip6 saddr $free_net6 ip6 daddr != $ext_net6 accept iif $pass_if ip6 saddr $pass_net6 accept iif $serv_if ip6 saddr $serv_net6 accept |