You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
88 lines
3.0 KiB
88 lines
3.0 KiB
# |
|
# rules.before |
|
# |
|
# Rules that should be run before the ufw command line added rules. Custom |
|
# rules should be added to one of these chains: |
|
# ufw-before-input |
|
# ufw-before-output |
|
# ufw-before-forward |
|
# |
|
|
|
# nat |
|
*nat |
|
-A POSTROUTING -o wlx503eaab62bc4 -j MASQUERADE |
|
#-A POSTROUTING -o wlx503eaab62bc4 -s 192.168.1.0/24 -j SNAT --to 10.10.14.152 |
|
#-A PREROUTING -i enxb827eb4bfae9 -j DNAT --to 192.168.1.2 |
|
COMMIT |
|
|
|
# Don't delete these required lines, otherwise there will be errors |
|
*filter |
|
:ufw-before-input - [0:0] |
|
:ufw-before-output - [0:0] |
|
:ufw-before-forward - [0:0] |
|
:ufw-not-local - [0:0] |
|
# End required lines |
|
|
|
# packet forwarding |
|
#-A FORWARD -i wlx503eaab62bc4 -o enxb827eb4bfae9 -m state --state RELATED,ESTABLISHED -j ACCEPT |
|
#-A FORWARD -i enxb827eb4bfae9 -o wlx503eaab62bc4 -j ACCEPT |
|
-A FORWARD -i enxb827eb4bfae9 -j ACCEPT |
|
|
|
# allow all on loopback |
|
-A ufw-before-input -i lo -j ACCEPT |
|
-A ufw-before-output -o lo -j ACCEPT |
|
|
|
# quickly process packets for which we already have a connection |
|
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
|
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
|
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
|
|
|
# drop INVALID packets (logs these in loglevel medium and higher) |
|
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny |
|
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP |
|
|
|
# ok icmp codes for INPUT |
|
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT |
|
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT |
|
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT |
|
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT |
|
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT |
|
|
|
# ok icmp code for FORWARD |
|
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT |
|
-A ufw-before-forward -p icmp --icmp-type source-quench -j ACCEPT |
|
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT |
|
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT |
|
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT |
|
|
|
# allow dhcp client to work |
|
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT |
|
|
|
# |
|
# ufw-not-local |
|
# |
|
-A ufw-before-input -j ufw-not-local |
|
|
|
# if LOCAL, RETURN |
|
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN |
|
|
|
# if MULTICAST, RETURN |
|
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN |
|
|
|
# if BROADCAST, RETURN |
|
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN |
|
|
|
# all other non-local packets are dropped |
|
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny |
|
-A ufw-not-local -j DROP |
|
|
|
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above |
|
# is uncommented) |
|
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT |
|
|
|
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above |
|
# is uncommented) |
|
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT |
|
|
|
# don't delete the 'COMMIT' line or these rules won't be processed |
|
COMMIT
|
|
|