54 lines
3.1 KiB
Django/Jinja
54 lines
3.1 KiB
Django/Jinja
#!/usr/sbin/nft -f
|
|
flush ruleset
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority filter;
|
|
policy drop;
|
|
iif "lo" accept
|
|
ct state established,related accept
|
|
ct state invalid drop
|
|
tcp dport 22 counter accept comment "ssh"
|
|
tcp dport 80 counter accept comment "http"
|
|
tcp dport 443 counter accept comment "https"
|
|
tcp dport 24444 counter accept comment "mcsmanager"
|
|
tcp dport { 5222, 5223, 5269, 5000, 5270, 5280 } counter accept comment "xmpp"
|
|
}
|
|
chain forward {
|
|
type filter hook forward priority filter;
|
|
policy drop;
|
|
ct state established,related accept
|
|
ip daddr {{ hostvars['coturn']['container_ip'] }} udp dport { 3478, 5349, 49152-65535 } counter accept
|
|
ip daddr {{ hostvars['coturn']['container_ip'] }} tcp dport { 3478, 5349 } counter accept
|
|
ip daddr {{ hostvars['mcsmanager']['container_ip'] }} tcp dport 25565 counter accept
|
|
ip daddr {{ hostvars['steamcmd']['container_ip'] }} udp dport 2456 counter accept
|
|
ip daddr {{ hostvars['steamcmd']['container_ip'] }} udp dport 2457 counter accept
|
|
ip daddr {{ hostvars['rbpi4']['container_ip'] }} udp dport 21116 counter accept
|
|
ip daddr {{ hostvars['rbpi4']['container_ip'] }} tcp dport 21114-21119 counter accept
|
|
iifname tun0 ip saddr {{ hostvars['workuter']['container_ip'] }} oifname tun0 ip daddr {{ hostvars['xiawrt']['container_ip'] }} tcp dport 22 counter accept
|
|
iifname tun0 ip saddr {{ hostvars['workuter']['container_ip'] }} oifname tun0 ip daddr {{ hostvars['rbpi4']['container_ip'] }} tcp dport 22 counter accept
|
|
iifname tun0 ip saddr {{ hostvars['oyacoi-odcm']['container_ip'] }} oifname tun0 ip daddr {{ hostvars['xiawrt']['container_ip'] }} tcp dport 22 counter accept
|
|
iifname tun0 ip saddr {{ hostvars['oyacoi-odcm']['container_ip'] }} oifname tun0 ip daddr {{ hostvars['rbpi4']['container_ip'] }} tcp dport 22 counter accept
|
|
}
|
|
chain output {
|
|
type filter hook output priority filter;
|
|
policy accept;
|
|
}
|
|
}
|
|
table ip nat {
|
|
chain prerouting {
|
|
type nat hook prerouting priority dstnat;
|
|
policy accept;
|
|
ip daddr {{ container_ip }} udp dport { 3478, 5349, 49152-65535 } counter dnat to {{ hostvars['coturn']['container_ip'] }}
|
|
ip daddr {{ container_ip }} tcp dport { 3478, 5349 } counter dnat to {{ hostvars['coturn']['container_ip'] }}
|
|
ip daddr {{ container_ip }} tcp dport 25565 counter dnat to {{ hostvars['mcsmanager']['container_ip'] }}
|
|
ip daddr {{ container_ip }} udp dport 2456 counter dnat to {{ hostvars['steamcmd']['container_ip'] }}
|
|
ip daddr {{ container_ip }} udp dport 2457 counter dnat to {{ hostvars['steamcmd']['container_ip'] }}
|
|
ip daddr {{ container_ip }} udp dport 21116 counter dnat to {{ hostvars['rbpi4']['container_ip'] }}
|
|
ip daddr {{ container_ip }} tcp dport 21114-21119 counter dnat to {{ hostvars['rbpi4']['container_ip'] }}
|
|
}
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat;
|
|
policy accept;
|
|
}
|
|
}
|