diff options
Diffstat (limited to 'etc/nftables.conf')
| -rw-r--r-- | etc/nftables.conf | 18 |
1 files changed, 17 insertions, 1 deletions
diff --git a/etc/nftables.conf b/etc/nftables.conf index b824edee..1ea06d6b 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -40,6 +40,7 @@ table inet my_table { tcp dport submission accept tcp dport imaps accept tcp dport pop3s accept + tcp dport monerod-p2p accept pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited counter comment "count any other traffic" @@ -68,11 +69,26 @@ table inet my_table { # Need inet to masquerade both ipv4 and ipv6? If use ip it will only masquerade ipv4? If use ip6 it will only masquerade ipv6? # https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families table inet nat { - # newer kernel no need for `chain prerouting { type nat hook prerouting priority -100; policy accept; }`, more see https://www.procustodibus.com/blog/2021/11/wireguard-nftables/ + # newer kernel no need for `chain prerouting { type nat hook prerouting priority -100; policy accept; }` if has `chain postrouting` + # also vice versa, no need `chain postrouting` if has `chain prerouting` + # more see https://www.procustodibus.com/blog/2021/11/wireguard-nftables/ + chain prerouting { + type nat hook prerouting priority -100 + policy accept + # port forwarding from client + # https://www.procustodibus.com/blog/2022/09/wireguard-port-forward-from-internet + iifname $pub_iface tcp dport monerod-p2p dnat ip to 10.0.0.1:monerod-p2p + iifname $pub_iface tcp dport monerod-p2p dnat ip6 to [fdc9:281f:04d7:9ee9::1]:monerod-p2p + } # for all packets to $pub_iface, after routing, replace source address with primary IP of $pub_iface interface chain postrouting { type nat hook postrouting priority 100 policy accept + # Needed for VPN. Needed for port forwarding from cilent with VPN through server + # https://www.procustodibus.com/blog/2022/09/wireguard-port-forward-from-internet/#default-route oifname $pub_iface masquerade + # needed for port forwarding from client without VPN through server + # https://www.procustodibus.com/blog/2022/09/wireguard-port-forward-from-internet/#masquerading + #oifname $wg_iface masquerade } } |