70 lines
3.0 KiB
Plaintext
70 lines
3.0 KiB
Plaintext
#!/usr/sbin/nft -f
|
|
# vanguard-stream host firewall. Own table so (re)applying never disturbs Docker's rules.
|
|
# Input only. MediaMTX runs on the host network, so 1935, 8890/udp and 8189 arrive through THIS chain (the
|
|
# accepts below). Docker-published ports (22000) arrive via Docker's forward chain and are
|
|
# listed here for the host-network case (Caddy) and clarity. Nothing else should listen publicly.
|
|
|
|
destroy table inet vanguard
|
|
table inet vanguard {
|
|
set ssh_allow {
|
|
type ipv4_addr
|
|
flags interval
|
|
# leave empty to allow SSH from anywhere (key auth, rate limited); or list CIDRs:
|
|
# elements = { 203.0.113.0/24, 198.51.100.7 }
|
|
}
|
|
|
|
set db_allow {
|
|
type ipv4_addr
|
|
flags interval
|
|
# MariaDB clients. Leave empty = anywhere (rate limited); or list the bot dev's IPs and then
|
|
# delete the "tcp dport 3306 ct state new accept" line below to restrict to this set.
|
|
# elements = { 203.0.113.7 }
|
|
}
|
|
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
iif lo accept
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
|
|
# icmp (ping, pmtu) and all icmpv6 (neighbor discovery is mandatory)
|
|
ip protocol icmp icmp type { echo-request, destination-unreachable, time-exceeded, parameter-problem } accept
|
|
ip6 nexthdr icmpv6 accept
|
|
|
|
# dhcp client replies (OVH may hand out the address by DHCP)
|
|
udp sport 67 udp dport 68 accept
|
|
|
|
# ssh: restricted to ssh_allow if it has entries, otherwise anywhere, rate limited
|
|
tcp dport 22 ct state new ip saddr @ssh_allow accept
|
|
tcp dport 22 ct state new limit rate over 15/minute burst 10 packets drop
|
|
tcp dport 22 ct state new accept
|
|
|
|
# public services
|
|
tcp dport { 80, 443 } accept # Caddy: copyparty, dock, dump
|
|
udp dport 443 accept # Caddy HTTP/3 (QUIC)
|
|
tcp dport 1935 accept # RTMP ingest
|
|
udp dport 8890 accept # SRT ingest
|
|
tcp dport 22000 accept # Syncthing
|
|
tcp dport 2222 accept # Gitea ssh (git clone/push)
|
|
udp dport 8189 accept # WebRTC media for the live portal
|
|
tcp dport 8189 accept # WebRTC ICE-TCP fallback
|
|
udp dport 22000 accept # Syncthing QUIC
|
|
|
|
# mariadb (host network): allowlist first, then anywhere with a brute-force limit
|
|
tcp dport 3306 ct state new ip saddr @db_allow accept
|
|
tcp dport 3306 ct state new limit rate over 30/minute burst 20 packets drop
|
|
tcp dport 3306 ct state new accept
|
|
|
|
# dumpd /mtx-auth for MediaMTX (container -> host gateway): only from Docker bridge interfaces
|
|
iifname { "docker0", "br-*" } tcp dport 8081 accept
|
|
|
|
# NOT opened on purpose — these bind to 127.0.0.1 only and are reached via Caddy or an ssh tunnel:
|
|
# 9000 authentik · 8096 jellyfin · 3923 copyparty · 8384 syncthing UI · 8080 dumpd
|
|
# Docker publishes them on loopback, so its NAT never forwards outside traffic to them either.
|
|
|
|
# everything else: drop (policy), but log a trickle for diagnosis
|
|
limit rate 5/minute log prefix "vg-drop " level info
|
|
}
|
|
}
|