Groups | Search | Server Info | Login | Register

Groups > comp.os.linux.security > #736

Basic netfilter config for Arch linux

Show all headers | View raw

Dear security experts, 




in order to resurrect my 2GB RAM netbook, I'm changing from SUSE linux to Arch linux. 

Also Arch linux is great, for example I'm enthusiast of how much RAM is still free after the system boots. 

I chose Arch linux also because it supports also the Raspberry Pi, which should be a sign of good philosophy and efficient use of the hardware. 

I'm setting up a netfilter firewall for my system, below you find my /etc/nftables.conf

Since I don't speak this netfilter language, I'm not able to check whether my system (I didn't set up any server, I'm directly connected with the DSL router of my inet provider) is reasonably protected.

I would be very grateful for your comments or suggestions. 


- /etc/nftables.conf :

#!/usr/bin/nft -f                                                                                                                                                                                




### ip filter , ip6 filter  : verbatim from: https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_workstation on 2018-10-31                                                    


# fw.basic (native)                                                                                                                                                                              
table ip filter {
     chain input {
          type filter hook input priority 0;

          # accept traffic originated from us                                                                                                                                                    
          ct state established,related accept

          # accept any localhost traffic                                                                                                                                                         
          iif lo accept

          # count and drop any other traffic                                                                                                                                                     
          counter drop
     }
}


# fw6.basic                                                                                                                                                                                      
table ip6 filter {
	chain input {
                 type filter hook input priority 0;

                 # accept any localhost traffic                                                                                                                                                  
                 iif lo accept

                 # accept traffic originated from us                                                                                                                                             
                 ct state established,related accept

                 # accept neighbour discovery otherwise connectivity breaks                                                                                                                      
                 icmpv6 type { nd-neighbor-solicit, echo-request, nd-router-advert, nd-neighbor-advert } accept

                 # count and drop any other traffic                                                                                                                                              
                 counter drop
        }
}






### inet filter is a /etc/nftables.conf of Arch linux 2018 , BUT I changed (only) the 2 lines marked with '!', where I just added 'counter' :                                                    



# ipv4/ipv6 Simple & Safe Firewall                                                                                                                                                               
# you can find examples in /usr/share/nftables/                                                                                                                                                  

table inet filter {
  chain input {
    type filter hook input priority 0;

    # allow established/related connections                                                                                                                                                      
    ct state {established, related} accept

    # early drop of invalid connections                                                                                                                                                          
    ct state invalid drop

    # allow from loopback                                                                                                                                                                        
    iifname lo accept

    # allow icmp                                                                                                                                                                                 
    ip protocol icmp accept
    ip6 nexthdr icmpv6 accept

    # allow ssh                                                                                                                                                                                  
    tcp dport ssh accept

    # everything else                                                                                                                                                                            
    counter reject with icmpx type port-unreachable # !                                                                                                                                          
  }
  chain forward {
    type filter hook forward priority 0;
    counter drop # !                                                                                                                                                                             
  }
  chain output {
    type filter hook output priority 0;
  }

}

# vim:set ts=2 sw=2 et:                                                                                                                                                                          

Back to comp.os.linux.security | Previous | Next | Find similar

Thread

Basic netfilter config for Arch linux m054lw@gmail.com - 2018-11-04 17:24 -0800

csiph-web