diff options
Diffstat (limited to 'opt/nftables')
| -rw-r--r-- | opt/nftables/.footprint | 43 | ||||
| -rw-r--r-- | opt/nftables/.signature | 6 | ||||
| -rw-r--r-- | opt/nftables/MAKEPKG | 73 | ||||
| -rw-r--r-- | opt/nftables/nftables.conf | 21 |
4 files changed, 143 insertions, 0 deletions
diff --git a/opt/nftables/.footprint b/opt/nftables/.footprint new file mode 100644 index 0000000..4dab9b7 --- /dev/null +++ b/opt/nftables/.footprint @@ -0,0 +1,43 @@ +drwxr-xr-x root/root etc/ +drwxr-xr-x root/root etc/nftables/ +drwxr-xr-x root/root etc/nftables/osf/ +-rw-r--r-- root/root etc/nftables/osf/pf.os +drwxr-xr-x root/root etc/sv/ +drwxr-xr-x root/root etc/sv/nftables/ +-rwxr-xr-x root/root etc/sv/nftables/finish +-rwxr-xr-x root/root etc/sv/nftables/run +drwxr-xr-x root/root etc/sv/nftables/log/ +-rwxr-xr-x root/root etc/sv/nftables/log/run +drwxr-xr-x root/root usr/ +drwxr-xr-x root/root usr/bin/ +-rwxr-xr-x root/root usr/bin/nft +drwxr-xr-x root/root usr/include/ +drwxr-xr-x root/root usr/include/nftables/ +-rw-r--r-- root/root usr/include/nftables/libnftables.h +drwxr-xr-x root/root usr/lib/ +-rwxr-xr-x root/root usr/lib/libnftables.so.1.1.0 +lrwxrwxrwx root/root usr/lib/libnftables.so -> libnftables.so.1.1.0 +lrwxrwxrwx root/root usr/lib/libnftables.so.1 -> libnftables.so.1.1.0 +drwxr-xr-x root/root usr/lib/pkgconfig/ +-rw-r--r-- root/root usr/lib/pkgconfig/libnftables.pc +drwxr-xr-x root/root usr/share/ +drwxr-xr-x root/root usr/share/nftables/ +-rw-r--r-- root/root usr/share/nftables/all-in-one.nft +-rw-r--r-- root/root usr/share/nftables/arp-filter.nft +-rw-r--r-- root/root usr/share/nftables/bridge-filter.nft +-rw-r--r-- root/root usr/share/nftables/inet-filter.nft +-rw-r--r-- root/root usr/share/nftables/inet-nat.nft +-rw-r--r-- root/root usr/share/nftables/ipv4-filter.nft +-rw-r--r-- root/root usr/share/nftables/ipv4-mangle.nft +-rw-r--r-- root/root usr/share/nftables/ipv4-nat.nft +-rw-r--r-- root/root usr/share/nftables/ipv4-raw.nft +-rw-r--r-- root/root usr/share/nftables/ipv6-filter.nft +-rw-r--r-- root/root usr/share/nftables/ipv6-mangle.nft +-rw-r--r-- root/root usr/share/nftables/ipv6-nat.nft +-rw-r--r-- root/root usr/share/nftables/ipv6-raw.nft +-rw-r--r-- root/root usr/share/nftables/netdev-ingress.nft +drwxr-xr-x root/root var/ +drwxr-xr-x root/root var/lib/ +drwxr-xr-x root/root var/lib/pkg/ +drwxr-xr-x root/root var/lib/pkg/meta/ +-rw-r--r-- root/root var/lib/pkg/meta/nftables diff --git a/opt/nftables/.signature b/opt/nftables/.signature new file mode 100644 index 0000000..5c5aa09 --- /dev/null +++ b/opt/nftables/.signature @@ -0,0 +1,6 @@ +RWTZ9IduCSQ/mI9sq7d6oCuRXeVIBM7rPpsDbRDFeNgE4sZA/iT33kY//h25xjIJTSOigTMsm1zFb0yQX5mK4yso6fWx50ynHQc= + +SHA256 (MAKEPKG) = 1970492e24ccb99f0d580f6d43576ed336111ad73d89c19db6bd1e786c1ea650 +SHA256 (.footprint) = f9842823089e1f9df9d66860c8d9ce973602fe63477ef0909edb768cf77cbbbc +SHA256 (nftables-1.1.7.tar.xz) = a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f +SHA256 (nftables#1.1.7-1.pkg.tar.gz) = 7d50c935c4e2731b921fb6d44d71fbf6cffb9bb8c22ffd1ae27a48fb4fdb1779 diff --git a/opt/nftables/MAKEPKG b/opt/nftables/MAKEPKG new file mode 100644 index 0000000..2dc8d4e --- /dev/null +++ b/opt/nftables/MAKEPKG @@ -0,0 +1,73 @@ +#!/bin/mkpkg +# description: Netfilter nftables - firewalling, NAT, and packet mangling for Linux (minimal) +# url: https://netfilter.org/projects/nftables/ + +# Note: This is a minimal build WITHOUT Python bindings + +name=nftables +version=1.1.7 +release=1 +depends=(libmnl libnftnl libedit gmp) +makedeps=(bison flex) +groups=(nftables) +services=(nftables) +source=( + https://www.netfilter.org/pub/nftables/nftables-$version.tar.xz +) +sha256sums=( + "a6fbf060d8d4fff001517a2b94f356bb4366bfbf0ba366366f9d27cc38caa58f" +) + +build() { + cd $name-$version + export CONFIG_SHELL=/bin/bash + ./configure \ + --prefix=/usr \ + --sbindir=/usr/bin \ + --sysconfdir=/etc \ + --with-cli=editline \ + --without-json \ + --without-python-bin \ + --disable-debug \ + --disable-man-doc \ + --disable-python + make + make DESTDIR=$PKG install + + rm -rf $PKG/usr/share/doc +} + +post_build() { + # runit service + install -d $PKG/etc/sv/nftables/log + + printf '%s\n' \ + '#!/bin/sh' \ + 'exec 2>&1' \ + '[ ! -r /etc/nftables.conf ] && exit 0' \ + 'nft -f /etc/nftables.conf' \ + 'exec chpst -b nftables pause' \ + > $PKG/etc/sv/nftables/run + + printf '%s\n' \ + '#!/bin/sh' \ + 'nft flush ruleset' \ + > $PKG/etc/sv/nftables/finish + + printf '%s\n' \ + '#!/bin/sh' \ + 'mkdir -p /var/log/nftables' \ + 'exec svlogd -tt /var/log/nftables' \ + > $PKG/etc/sv/nftables/log/run + + chmod 755 $PKG/etc/sv/nftables/run + chmod 755 $PKG/etc/sv/nftables/finish + chmod 755 $PKG/etc/sv/nftables/log/run +} + +signify() { + untrusted comment: public key + RWTZ9IduCSQ/mL8337TEUinPwT92xFEUpD92hkS7IxcOnzTt9QdpohT3 +} + +# vim: filetype=sh diff --git a/opt/nftables/nftables.conf b/opt/nftables/nftables.conf new file mode 100644 index 0000000..c0b3b27 --- /dev/null +++ b/opt/nftables/nftables.conf @@ -0,0 +1,21 @@ +#!/usr/bin/nft -f + +## This is a basic workstation configuration based on +## https://wiki.nftables.org/wiki-nftables/index.php/Simple_ruleset_for_a_workstation + +flush ruleset + +table ip filter { + chain input { + type filter hook input priority 0; policy drop; + + # accept any localhost traffic + iif lo accept + + # accept traffic originated from us + ct state established,related accept + + # accept ssh logins via port 22 + tcp dport 22 accept comment "Accept SSH on port 22" + } +} |