Nftables防火墙配置#

1
sudo tee /etc/nftables.conf > /dev/null <<'EOF'
2
#!/usr/sbin/nft -f
3

4
flush ruleset
5

6
table ip filter {
7
    chain input {
8
        type filter hook input priority filter; policy drop;
9

10
        iifname "lo" accept
11

12
        ct state established,related accept
13

14
        ct state invalid drop
15

16
        icmp type {
17
            destination-unreachable,
18
            time-exceeded,
19
            parameter-problem
20
        } accept
21

22
        tcp dport 48256 ct state new accept
23

24
        counter drop
25
    }
26

27
    chain forward {
28
        type filter hook forward priority filter; policy drop;
29
    }
30

31
    chain output {
32
        type filter hook output priority filter; policy accept;
33
    }
34
}
35
EOF