server.conf - main - linux_lab/ovpnft

server.conf
71 строка2 KB
ophilon
base files
12 май 2026, 19:21
12 май 2026, 19:212945bf5
#!/usr/sbin/nft -f

# NFTables firewall configuration for OpenVPN server
# Variables (to be defined before loading):
define eth_local = enp1s0
define ip4_internal = 192.168.100.122 # ip4 address on internal interface (eth_local)
#   $ip4_internal    - IPv4 address on internal interface (eth_local)
#   $ip6_internal    - IPv6 address on internal interface (eth_local)
#   $ip4_external    - IPv4 address on external interface (lo)
#   $ip6_external    - IPv6 address on external interface (lo)
#   $local_network   - Local network CIDR (e.g., 192.168.100.0/24)
define local_network = 192.168.100.0/24

# Flush existing ruleset
flush ruleset

# Define tables
table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;

        # Accept established/related connections
        ct state established,related accept

        # Accept loopback traffic
        iif lo accept

        # Internal interface (eth_local) - SSH only
        iif $eth_local ip saddr $local_network tcp dport 22 accept
        iif $eth_local ip6 saddr fe80::/10 tcp dport 22 accept

        # External interface (lo) - OpenVPN only
        iif lo tcp dport 1194 accept
        iif lo udp dport 1194 accept

        # ICMP for diagnostics
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept

        # Log dropped packets
        log prefix "nftables-input-drop: " group 0
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        # Allow forwarding from internal to external
        iif $eth_local oif lo accept
        iif lo oif $eth_local ct state established,related accept

        # Log dropped packets
        log prefix "nftables-forward-drop: " group 0
    }

    chain output {
        type filter hook output priority 0; policy accept;
    }
}

table ip nat {
    chain prerouting {
        type nat hook prerouting priority -100; policy accept;
    }

    chain postrouting {
        type nat hook postrouting priority 100; policy accept;

        # Masquerade all traffic going to external network
        oif != $eth_local masquerade
    }
}