34 lines
1.2 KiB
Text
34 lines
1.2 KiB
Text
#!/usr/sbin/nft -f
|
|
# NOTE: deliberately does NOT `flush ruleset` - that wipes Docker's own
|
|
# iptables-nft managed nat/filter tables too, breaking container port
|
|
# publishing on `docker compose up` (confirmed live: this exact mistake
|
|
# broke Graylog's Docker network and had to be recovered with a full
|
|
# `docker compose down && up`). Only this table is touched, and only this
|
|
# table's own rules are flushed - safe whether or not it already exists,
|
|
# and safe regardless of nftables.service vs docker.service start order.
|
|
|
|
add table inet filter
|
|
flush table inet filter
|
|
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority 0; policy drop;
|
|
|
|
iif lo accept
|
|
ct state established,related accept
|
|
ip protocol icmp accept
|
|
|
|
tcp dport 9000 accept # Graylog Web UI / REST API
|
|
udp dport 514 accept # syslog, standard port (most network gear can't use anything else)
|
|
udp dport 1514 accept # syslog, network equipment that can use a custom port
|
|
udp dport 5140 accept # syslog, servers (RADIUS/accel-ppp)
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority 0; policy accept;
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority 0; policy accept;
|
|
}
|
|
}
|