35 lines
624 B
Plaintext
35 lines
624 B
Plaintext
|
#!/usr/sbin/nft -f
|
||
|
|
|
||
|
|
flush ruleset
|
||
|
|
|
||
|
|
table inet filter {
|
||
|
|
chain input {
|
||
|
|
type filter hook input priority filter;
|
||
|
|
}
|
||
|
|
chain forward {
|
||
|
|
type filter hook forward priority filter;
|
||
|
|
}
|
||
|
|
chain output {
|
||
|
|
type filter hook output priority filter;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
table ip filter {
|
||
|
|
chain forward {
|
||
|
|
type filter hook forward priority 0; policy drop;
|
||
|
|
|
||
|
|
# Allow existing connections
|
||
|
|
iifname "ens4" oifname "ens5" ct state { established, related } accept
|
||
|
|
|
||
|
|
# Allow new outgoing traffic
|
||
|
|
iifname "ens5" oifname "ens4" accept
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
table ip nat {
|
||
|
|
chain postrouting {
|
||
|
|
type nat hook postrouting priority 100;
|
||
|
|
oifname "ens4" masquerade
|
||
|
|
}
|
||
|
|
}
|