nftables
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| nftables [2020/02/14 09:33] – [The Pravidla] ww | nftables [2026/06/20 15:35] (current) – external edit 127.0.0.1 | ||
|---|---|---|---|
| Line 93: | Line 93: | ||
| jump global | jump global | ||
| + | | ||
| + | # loopback | ||
| + | oif lo accept | ||
| tcp dport $port_dns accept | tcp dport $port_dns accept | ||
| Line 115: | Line 118: | ||
| } | } | ||
| + | </ | ||
| + | |||
| + | ---- | ||
| + | |||
| + | ===== The Masquerade ===== | ||
| + | |||
| + | < | ||
| + | table ip nat { | ||
| + | chain postrouting { | ||
| + | type nat hook postrouting priority 100; | ||
| + | oif $iface_wan masquerade; | ||
| + | } | ||
| + | } | ||
| </ | </ | ||
| Line 120: | Line 136: | ||
| ===== The NAT ===== | ===== The NAT ===== | ||
| + | |||
| + | < | ||
| + | table inet filter { | ||
| + | chain forward { | ||
| + | type filter hook forward priority 0; | ||
| + | policy drop; | ||
| + | |||
| + | jump global | ||
| + | |||
| + | # [...] | ||
| + | |||
| + | ip daddr 192.168.1.10 tcp dport 3389 accept | ||
| + | |||
| + | counter drop | ||
| + | } | ||
| + | } | ||
| + | |||
| + | </ | ||
| < | < | ||
| Line 128: | Line 162: | ||
| | | ||
| iif " | iif " | ||
| + | } | ||
| + | } | ||
| + | </ | ||
| + | |||
| + | ===== Docker smrdí ===== | ||
| + | |||
| + | ==== Komunikace host <-> container ==== | ||
| + | - Smazat ''/ | ||
| + | - Udělat si override pro síť dockeru, aby se daly ručně specifikovat pravidla na vyžádané IP adresy: | ||
| + | '' | ||
| + | <code json>{ | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | " | ||
| + | }</ | ||
| + | |||
| + | - Přidat do nftables: | ||
| + | < | ||
| + | table inet filter { | ||
| + | chain output { | ||
| + | # Docker | ||
| + | oifname " | ||
| } | } | ||
| } | } | ||
| </ | </ | ||
nftables.1581672836.txt.gz · Last modified: (external edit)