edb4c397df
Upstream: https://github.com/YunoHost/yunohost @ 3a5f8bac8301c450897b96cbd43a4c7d3ba750fb But (José) : transformer tout le code en bions + ploxions du xerboxion. La carte de digestion vit au labo : /yunohost-digest.json
26 lines
998 B
Plaintext
26 lines
998 B
Plaintext
#!/usr/sbin/nft -f
|
|
|
|
define tcp_ports = { {{ tcp_ports.strip().split(' ') | join(', ') }} }
|
|
{% if udp_ports.strip() %}
|
|
define udp_ports = { {{ udp_ports.strip().split(' ') | join(', ') }} }
|
|
{% endif %}
|
|
|
|
table inet filter {
|
|
chain input {
|
|
policy drop;
|
|
ct state related,established counter accept;
|
|
|
|
tcp dport $tcp_ports counter accept;
|
|
{% if udp_ports.strip() %}
|
|
udp dport $udp_ports counter accept;
|
|
{% endif %}
|
|
|
|
udp sport 1900 udp dport >= 1024 ip6 saddr { fd00::/8, fe80::/10 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
|
|
udp sport 1900 udp dport >= 1024 ip saddr { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16 } meta pkttype unicast limit rate 4/second burst 20 packets accept comment "Accept UPnP IGD port mapping reply"
|
|
|
|
iifname "lo" counter accept;
|
|
ip protocol icmp counter accept;
|
|
ip6 nexthdr icmpv6 counter accept;
|
|
}
|
|
}
|