From 9ee3593c058fabe816a2cc10984a41b20cf9aba9 Mon Sep 17 00:00:00 2001 From: Your Name Date: Fri, 27 Sep 2024 23:41:07 -0600 Subject: [PATCH] ifixo --- ipv4-filter.nft | 6 +++--- modules/module-rate-limit-web-port-forward.sh | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/ipv4-filter.nft b/ipv4-filter.nft index a918e44..cdb0707 100644 --- a/ipv4-filter.nft +++ b/ipv4-filter.nft @@ -1,5 +1,6 @@ table filter { - chain input { type filter hook input priority 0;policy accept;} + set http_ratelimit { type ipv4_addr; timeout 1s; flags dynamic; } + chain input { type filter hook input priority 0;policy drop;} chain forward { type filter hook forward priority 0; iifname wg0 accept; iifname home accept; @@ -9,7 +10,7 @@ table filter { chain output { type filter hook output priority 0; } } -table inet t_nat { +table nat { chain prerouting { type nat hook prerouting priority -100; policy accept;} chain postrouting { type nat hook postrouting priority 100; iifname wg0 oifname eno1 masquerade; @@ -18,4 +19,3 @@ table inet t_nat { iifname eno1 oifname home masquerade; } } - diff --git a/modules/module-rate-limit-web-port-forward.sh b/modules/module-rate-limit-web-port-forward.sh index 39e3598..bd9a3ee 100644 --- a/modules/module-rate-limit-web-port-forward.sh +++ b/modules/module-rate-limit-web-port-forward.sh @@ -16,6 +16,6 @@ $NFT add rule ip filter input ct state new tcp dport 443 update @http_ratelimit $NFT add rule ip filter input ct state new tcp dport 80 update @http_ratelimit { ip saddr limit rate $1/second } accept -$NFT add rule ip forward prerouting tcp dport 80 dnat to 192.168.0.55 -$NFT add rule ip forward prerouting tcp dport 443 dnat to 192.168.0.55 -$NFT add rule ip forward postrouting ip daddr 192.168.0.55 masquerade +$NFT add rule ip nat prerouting tcp dport 80 ip saddr 192.168.0.0/24 dnat to 192.168.0.55 +$NFT add rule ip nat prerouting tcp dport 443 ip saddr 192.168.0.0/24 dnat to 192.168.0.55 +$NFT add rule ip nat postrouting ip daddr 192.168.0.55 masquerade