INT-firewall konfiguration
From Datateknik
(Difference between revisions)
(→Detta är ett scripts som ...) |
(→Detta är ett scripts som ...) |
||
| Line 18: | Line 18: | ||
chain input { | chain input { | ||
type filter hook input priority 0; | type filter hook input priority 0; | ||
| − | policy drop; | + | policy '''drop'''; |
| − | tcp dport ssh | + | tcp dport ssh counter packets 0 bytes 0 '''accept''' comment "Accept incoming SSH on port 22 via both IPv4 and IPv6" |
counter packets 0 bytes 0 | counter packets 0 bytes 0 | ||
| Line 27: | Line 27: | ||
chain forward { | chain forward { | ||
type filter hook forward priority 0; | type filter hook forward priority 0; | ||
| − | policy drop; | + | policy '''drop'''; |
counter packets 0 bytes 0 comment "This should always be ZERO, because this device should NOT route packets" | counter packets 0 bytes 0 comment "This should always be ZERO, because this device should NOT route packets" | ||
} | } | ||
| Line 33: | Line 33: | ||
chain output { | chain output { | ||
type filter hook output priority 0; | type filter hook output priority 0; | ||
| − | policy accept; | + | policy '''accept'''; |
counter packets 0 bytes 0 comment "Count outgoing packets" | counter packets 0 bytes 0 comment "Count outgoing packets" | ||
} | } | ||
Revision as of 13:49, 21 January 2020
Nedanstående fungerar ej!
Gamla FirewallD
- Tag bort firewalld!
- Om du i en annan kurs måste konfa FirewallD -> titta inte här http://catch-up.cnap.hv.se/wiki/index.php?title=firewalld_konfiguration
Bara ETT nätverkskort
Kontrollera att du bara har ett (1) nätverkskort med kommandot: ifconfig
(två om du räknar loopback)
Detta är ett scripts som ...
... tar bort allt gammalt, och skapar en ny ACL
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0;
policy drop;
tcp dport ssh counter packets 0 bytes 0 accept comment "Accept incoming SSH on port 22 via both IPv4 and IPv6"
counter packets 0 bytes 0
}
chain forward {
type filter hook forward priority 0;
policy drop;
counter packets 0 bytes 0 comment "This should always be ZERO, because this device should NOT route packets"
}
chain output {
type filter hook output priority 0;
policy accept;
counter packets 0 bytes 0 comment "Count outgoing packets"
}
KOLLA HUR DET BLEV
nft list ruleset
