1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
|
#!/bin/bash
set -e
RULESET="table inet filter {
set udp_accepted {
type inet_service;
elements = {
isakmp, ipsec-nat-t
}
}
set tcp_accepted {
type inet_service;
elements = {
http, https
}
}
chain udp_input {
udp dport 1-128 accept
udp dport @udp_accepted accept
udp dport domain accept
}
chain tcp_input {
tcp dport 1-128 accept
tcp dport 8888-9999 accept
tcp dport @tcp_accepted accept
tcp dport 1024-65535 accept
}
}"
$NFT -o -f - <<< $RULESET
|
