55 lines
1.7 KiB
Text
55 lines
1.7 KiB
Text
|
table inet le_app_codex {
|
||
|
|
set approved_dns4 {
|
||
|
|
type ipv4_addr
|
||
|
|
flags interval
|
||
|
|
elements = { 9.9.9.9, 149.112.112.112 }
|
||
|
|
}
|
||
|
|
|
||
|
|
set operator_host_public4 {
|
||
|
|
type ipv4_addr
|
||
|
|
flags interval
|
||
|
|
elements = { 74.67.173.56 }
|
||
|
|
}
|
||
|
|
|
||
|
|
set denied4 {
|
||
|
|
type ipv4_addr
|
||
|
|
flags interval
|
||
|
|
elements = {
|
||
|
|
0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
|
||
|
|
169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24,
|
||
|
|
192.0.2.0/24, 192.88.99.0/24, 192.168.0.0/16,
|
||
|
|
198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24,
|
||
|
|
224.0.0.0/4, 240.0.0.0/4
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
chain input {
|
||
|
|
type filter hook input priority filter; policy accept;
|
||
|
|
iifname "lecodex-host" ct state established,related accept
|
||
|
|
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
|
||
|
|
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
|
||
|
|
iifname "lecodex-host" counter drop
|
||
|
|
}
|
||
|
|
|
||
|
|
chain forward {
|
||
|
|
type filter hook forward priority filter; policy accept;
|
||
|
|
oifname "lecodex-host" ct state established,related accept
|
||
|
|
oifname "lecodex-host" counter drop
|
||
|
|
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
|
||
|
|
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
|
||
|
|
iifname "lecodex-host" ip daddr @operator_host_public4 counter drop
|
||
|
|
iifname "lecodex-host" ip daddr @denied4 counter drop
|
||
|
|
iifname "lecodex-host" meta nfproto ipv6 counter drop
|
||
|
|
iifname "lecodex-host" tcp dport { 25, 465, 587 } counter drop
|
||
|
|
iifname "lecodex-host" tcp dport { 80, 443 } accept
|
||
|
|
iifname "lecodex-host" counter drop
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
table ip le_app_codex_nat {
|
||
|
|
chain postrouting {
|
||
|
|
type nat hook postrouting priority srcnat; policy accept;
|
||
|
|
ip saddr 10.200.120.0/30 oifname != "lecodex-host" masquerade
|
||
|
|
}
|
||
|
|
}
|