Attachment 1974292 Details for Bug 2216972 – nftables list ruleset output on first affected machine

nftables list ruleset output on first affected machine

firewalld.nftables.txt (text/plain), 11.47 KB, created by Anthony Messina on 2023-07-06 12:32:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Anthony Messina

Created: 2023-07-06 12:32:52 UTC

Size: 11.47 KB

patch

obsolete

>table inet firewalld {
>	set blocknet {
>		type ipv4_addr
>		flags interval
>	}
>
>	set blocknet6 {
>		type ipv6_addr
>		flags interval
>	}
>
>	set mss {
>		type ipv4_addr
>		flags interval
>		elements = { 10.77.0.0/22 }
>	}
>
>	set mss6 {
>		type ipv6_addr
>		flags interval
>		elements = { 2001:470:c1dc::/62,
>			     2603:300a:1b9:7520::/62,
>			     2603:300a:1b9:7540::/62,
>			     2603:300a:1b9:7560::/62,
>			     2603:300a:1b9:7580::/62,
>			     2603:300a:1b9:75a0::/62,
>			     2603:300a:1b9:75c0::/62,
>			     2603:300a:1b9:75e0::/62,
>			     fd00:a::/62 }
>	}
>
>	chain mangle_PREROUTING {
>		type filter hook prerouting priority mangle + 10; policy accept;
>		jump mangle_PREROUTING_ZONES
>	}
>
>	chain mangle_PREROUTING_POLICIES_pre {
>		jump mangle_PRE_policy_allow-host-ipv6
>		jump mangle_PRE_policy_blocknet
>	}
>
>	chain mangle_PREROUTING_ZONES {
>		ip saddr @mss goto mangle_PRE_mss
>		ip6 saddr @mss6 goto mangle_PRE_mss
>		goto mangle_PRE_public
>	}
>
>	chain mangle_PREROUTING_POLICIES_post {
>	}
>
>	chain nat_PREROUTING {
>		type nat hook prerouting priority dstnat + 10; policy accept;
>		jump nat_PREROUTING_ZONES
>	}
>
>	chain nat_PREROUTING_POLICIES_pre {
>		jump nat_PRE_policy_allow-host-ipv6
>		jump nat_PRE_policy_blocknet
>	}
>
>	chain nat_PREROUTING_ZONES {
>		ip saddr @mss goto nat_PRE_mss
>		ip6 saddr @mss6 goto nat_PRE_mss
>		goto nat_PRE_public
>	}
>
>	chain nat_PREROUTING_POLICIES_post {
>	}
>
>	chain nat_POSTROUTING {
>		type nat hook postrouting priority srcnat + 10; policy accept;
>		jump nat_POSTROUTING_ZONES
>	}
>
>	chain nat_POSTROUTING_POLICIES_pre {
>	}
>
>	chain nat_POSTROUTING_ZONES {
>		ip daddr @mss goto nat_POST_mss
>		ip6 daddr @mss6 goto nat_POST_mss
>		goto nat_POST_public
>	}
>
>	chain nat_POSTROUTING_POLICIES_post {
>	}
>
>	chain nat_OUTPUT {
>		type nat hook output priority -90; policy accept;
>		jump nat_OUTPUT_POLICIES_pre
>		jump nat_OUTPUT_POLICIES_post
>	}
>
>	chain nat_OUTPUT_POLICIES_pre {
>	}
>
>	chain nat_OUTPUT_POLICIES_post {
>	}
>
>	chain filter_PREROUTING {
>		type filter hook prerouting priority filter + 10; policy accept;
>		icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
>		meta nfproto ipv6 fib saddr . mark . iif oif missing drop
>	}
>
>	chain filter_INPUT {
>		type filter hook input priority filter + 10; policy accept;
>		ct state { established, related } accept
>		ct status dnat accept
>		iifname "lo" accept
>		ct state invalid drop
>		jump filter_INPUT_ZONES
>		reject with icmpx admin-prohibited
>	}
>
>	chain filter_FORWARD {
>		type filter hook forward priority filter + 10; policy accept;
>		ct state { established, related } accept
>		ct status dnat accept
>		iifname "lo" accept
>		ct state invalid drop
>		ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
>		jump filter_FORWARD_ZONES
>		reject with icmpx admin-prohibited
>	}
>
>	chain filter_OUTPUT {
>		type filter hook output priority filter + 10; policy accept;
>		ct state { established, related } accept
>		oifname "lo" accept
>		ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
>		jump filter_OUTPUT_POLICIES_pre
>		jump filter_OUTPUT_POLICIES_post
>	}
>
>	chain filter_INPUT_POLICIES_pre {
>		jump filter_IN_policy_allow-host-ipv6
>		jump filter_IN_policy_blocknet
>	}
>
>	chain filter_INPUT_ZONES {
>		ip saddr @mss goto filter_IN_mss
>		ip6 saddr @mss6 goto filter_IN_mss
>		goto filter_IN_public
>	}
>
>	chain filter_INPUT_POLICIES_post {
>	}
>
>	chain filter_FORWARD_POLICIES_pre {
>	}
>
>	chain filter_FORWARD_ZONES {
>		ip saddr @mss goto filter_FWD_mss
>		ip6 saddr @mss6 goto filter_FWD_mss
>		goto filter_FWD_public
>	}
>
>	chain filter_FORWARD_POLICIES_post {
>	}
>
>	chain filter_OUTPUT_POLICIES_pre {
>	}
>
>	chain filter_OUTPUT_POLICIES_post {
>	}
>
>	chain filter_IN_mss {
>		jump filter_INPUT_POLICIES_pre
>		jump filter_IN_mss_pre
>		jump filter_IN_mss_log
>		jump filter_IN_mss_deny
>		jump filter_IN_mss_allow
>		jump filter_IN_mss_post
>		jump filter_INPUT_POLICIES_post
>		meta l4proto { icmp, ipv6-icmp } accept
>		reject with icmpx admin-prohibited
>	}
>
>	chain filter_IN_mss_pre {
>	}
>
>	chain filter_IN_mss_log {
>	}
>
>	chain filter_IN_mss_deny {
>	}
>
>	chain filter_IN_mss_allow {
>		tcp dport 5355 accept
>		ip daddr 224.0.0.252 udp dport 5355 accept
>		ip6 daddr ff02::1:3 udp dport 5355 accept
>		ip daddr 224.0.0.251 udp dport 5353 accept
>		ip6 daddr ff02::fb udp dport 5353 accept
>		tcp dport 22 accept
>		tcp dport 3551 accept
>		tcp dport 443 accept
>		ether saddr 00:18:dd:07:61:fa accept
>	}
>
>	chain filter_IN_mss_post {
>	}
>
>	chain nat_POST_mss {
>		jump nat_POSTROUTING_POLICIES_pre
>		jump nat_POST_mss_pre
>		jump nat_POST_mss_log
>		jump nat_POST_mss_deny
>		jump nat_POST_mss_allow
>		jump nat_POST_mss_post
>		jump nat_POSTROUTING_POLICIES_post
>	}
>
>	chain nat_POST_mss_pre {
>	}
>
>	chain nat_POST_mss_log {
>	}
>
>	chain nat_POST_mss_deny {
>	}
>
>	chain nat_POST_mss_allow {
>	}
>
>	chain nat_POST_mss_post {
>	}
>
>	chain filter_FWD_mss {
>		jump filter_FORWARD_POLICIES_pre
>		jump filter_FWD_mss_pre
>		jump filter_FWD_mss_log
>		jump filter_FWD_mss_deny
>		jump filter_FWD_mss_allow
>		jump filter_FWD_mss_post
>		jump filter_FORWARD_POLICIES_post
>		reject with icmpx admin-prohibited
>	}
>
>	chain filter_FWD_mss_pre {
>	}
>
>	chain filter_FWD_mss_log {
>	}
>
>	chain filter_FWD_mss_deny {
>	}
>
>	chain filter_FWD_mss_allow {
>	}
>
>	chain filter_FWD_mss_post {
>	}
>
>	chain nat_PRE_mss {
>		jump nat_PREROUTING_POLICIES_pre
>		jump nat_PRE_mss_pre
>		jump nat_PRE_mss_log
>		jump nat_PRE_mss_deny
>		jump nat_PRE_mss_allow
>		jump nat_PRE_mss_post
>		jump nat_PREROUTING_POLICIES_post
>	}
>
>	chain nat_PRE_mss_pre {
>	}
>
>	chain nat_PRE_mss_log {
>	}
>
>	chain nat_PRE_mss_deny {
>	}
>
>	chain nat_PRE_mss_allow {
>	}
>
>	chain nat_PRE_mss_post {
>	}
>
>	chain mangle_PRE_mss {
>		jump mangle_PREROUTING_POLICIES_pre
>		jump mangle_PRE_mss_pre
>		jump mangle_PRE_mss_log
>		jump mangle_PRE_mss_deny
>		jump mangle_PRE_mss_allow
>		jump mangle_PRE_mss_post
>		jump mangle_PREROUTING_POLICIES_post
>	}
>
>	chain mangle_PRE_mss_pre {
>	}
>
>	chain mangle_PRE_mss_log {
>	}
>
>	chain mangle_PRE_mss_deny {
>	}
>
>	chain mangle_PRE_mss_allow {
>	}
>
>	chain mangle_PRE_mss_post {
>	}
>
>	chain filter_IN_public {
>		jump filter_INPUT_POLICIES_pre
>		jump filter_IN_public_pre
>		jump filter_IN_public_log
>		jump filter_IN_public_deny
>		jump filter_IN_public_allow
>		jump filter_IN_public_post
>		jump filter_INPUT_POLICIES_post
>		meta l4proto { icmp, ipv6-icmp } accept
>		reject with icmpx admin-prohibited
>	}
>
>	chain filter_IN_public_pre {
>	}
>
>	chain filter_IN_public_log {
>	}
>
>	chain filter_IN_public_deny {
>	}
>
>	chain filter_IN_public_allow {
>		ip daddr 224.0.0.251 udp dport 5353 accept
>		ip6 daddr ff02::fb udp dport 5353 accept
>		ip6 daddr fe80::/64 udp dport 546 accept
>	}
>
>	chain filter_IN_public_post {
>	}
>
>	chain nat_POST_public {
>		jump nat_POSTROUTING_POLICIES_pre
>		jump nat_POST_public_pre
>		jump nat_POST_public_log
>		jump nat_POST_public_deny
>		jump nat_POST_public_allow
>		jump nat_POST_public_post
>		jump nat_POSTROUTING_POLICIES_post
>	}
>
>	chain nat_POST_public_pre {
>	}
>
>	chain nat_POST_public_log {
>	}
>
>	chain nat_POST_public_deny {
>	}
>
>	chain nat_POST_public_allow {
>	}
>
>	chain nat_POST_public_post {
>	}
>
>	chain filter_FWD_public {
>		jump filter_FORWARD_POLICIES_pre
>		jump filter_FWD_public_pre
>		jump filter_FWD_public_log
>		jump filter_FWD_public_deny
>		jump filter_FWD_public_allow
>		jump filter_FWD_public_post
>		jump filter_FORWARD_POLICIES_post
>		reject with icmpx admin-prohibited
>	}
>
>	chain filter_FWD_public_pre {
>	}
>
>	chain filter_FWD_public_log {
>	}
>
>	chain filter_FWD_public_deny {
>	}
>
>	chain filter_FWD_public_allow {
>	}
>
>	chain filter_FWD_public_post {
>	}
>
>	chain nat_PRE_public {
>		jump nat_PREROUTING_POLICIES_pre
>		jump nat_PRE_public_pre
>		jump nat_PRE_public_log
>		jump nat_PRE_public_deny
>		jump nat_PRE_public_allow
>		jump nat_PRE_public_post
>		jump nat_PREROUTING_POLICIES_post
>	}
>
>	chain nat_PRE_public_pre {
>	}
>
>	chain nat_PRE_public_log {
>	}
>
>	chain nat_PRE_public_deny {
>	}
>
>	chain nat_PRE_public_allow {
>	}
>
>	chain nat_PRE_public_post {
>	}
>
>	chain mangle_PRE_public {
>		jump mangle_PREROUTING_POLICIES_pre
>		jump mangle_PRE_public_pre
>		jump mangle_PRE_public_log
>		jump mangle_PRE_public_deny
>		jump mangle_PRE_public_allow
>		jump mangle_PRE_public_post
>		jump mangle_PREROUTING_POLICIES_post
>	}
>
>	chain mangle_PRE_public_pre {
>	}
>
>	chain mangle_PRE_public_log {
>	}
>
>	chain mangle_PRE_public_deny {
>	}
>
>	chain mangle_PRE_public_allow {
>	}
>
>	chain mangle_PRE_public_post {
>	}
>
>	chain filter_IN_policy_allow-host-ipv6 {
>		jump filter_IN_policy_allow-host-ipv6_pre
>		jump filter_IN_policy_allow-host-ipv6_log
>		jump filter_IN_policy_allow-host-ipv6_deny
>		jump filter_IN_policy_allow-host-ipv6_allow
>		jump filter_IN_policy_allow-host-ipv6_post
>	}
>
>	chain filter_IN_policy_allow-host-ipv6_pre {
>	}
>
>	chain filter_IN_policy_allow-host-ipv6_log {
>	}
>
>	chain filter_IN_policy_allow-host-ipv6_deny {
>	}
>
>	chain filter_IN_policy_allow-host-ipv6_allow {
>		icmpv6 type nd-neighbor-advert accept
>		icmpv6 type nd-neighbor-solicit accept
>		icmpv6 type nd-router-advert accept
>		icmpv6 type nd-redirect accept
>	}
>
>	chain filter_IN_policy_allow-host-ipv6_post {
>	}
>
>	chain nat_PRE_policy_allow-host-ipv6 {
>		jump nat_PRE_policy_allow-host-ipv6_pre
>		jump nat_PRE_policy_allow-host-ipv6_log
>		jump nat_PRE_policy_allow-host-ipv6_deny
>		jump nat_PRE_policy_allow-host-ipv6_allow
>		jump nat_PRE_policy_allow-host-ipv6_post
>	}
>
>	chain nat_PRE_policy_allow-host-ipv6_pre {
>	}
>
>	chain nat_PRE_policy_allow-host-ipv6_log {
>	}
>
>	chain nat_PRE_policy_allow-host-ipv6_deny {
>	}
>
>	chain nat_PRE_policy_allow-host-ipv6_allow {
>	}
>
>	chain nat_PRE_policy_allow-host-ipv6_post {
>	}
>
>	chain mangle_PRE_policy_allow-host-ipv6 {
>		jump mangle_PRE_policy_allow-host-ipv6_pre
>		jump mangle_PRE_policy_allow-host-ipv6_log
>		jump mangle_PRE_policy_allow-host-ipv6_deny
>		jump mangle_PRE_policy_allow-host-ipv6_allow
>		jump mangle_PRE_policy_allow-host-ipv6_post
>	}
>
>	chain mangle_PRE_policy_allow-host-ipv6_pre {
>	}
>
>	chain mangle_PRE_policy_allow-host-ipv6_log {
>	}
>
>	chain mangle_PRE_policy_allow-host-ipv6_deny {
>	}
>
>	chain mangle_PRE_policy_allow-host-ipv6_allow {
>	}
>
>	chain mangle_PRE_policy_allow-host-ipv6_post {
>	}
>
>	chain filter_IN_policy_blocknet {
>		jump filter_IN_policy_blocknet_pre
>		jump filter_IN_policy_blocknet_log
>		jump filter_IN_policy_blocknet_deny
>		jump filter_IN_policy_blocknet_allow
>		jump filter_IN_policy_blocknet_post
>	}
>
>	chain filter_IN_policy_blocknet_pre {
>	}
>
>	chain filter_IN_policy_blocknet_log {
>		ip saddr @blocknet log prefix "blocknet: " level notice
>		ip6 saddr @blocknet6 log prefix "blocknet6: " level notice
>	}
>
>	chain filter_IN_policy_blocknet_deny {
>		ip saddr @blocknet drop
>		ip6 saddr @blocknet6 drop
>	}
>
>	chain filter_IN_policy_blocknet_allow {
>	}
>
>	chain filter_IN_policy_blocknet_post {
>	}
>
>	chain nat_PRE_policy_blocknet {
>		jump nat_PRE_policy_blocknet_pre
>		jump nat_PRE_policy_blocknet_log
>		jump nat_PRE_policy_blocknet_deny
>		jump nat_PRE_policy_blocknet_allow
>		jump nat_PRE_policy_blocknet_post
>	}
>
>	chain nat_PRE_policy_blocknet_pre {
>	}
>
>	chain nat_PRE_policy_blocknet_log {
>	}
>
>	chain nat_PRE_policy_blocknet_deny {
>	}
>
>	chain nat_PRE_policy_blocknet_allow {
>	}
>
>	chain nat_PRE_policy_blocknet_post {
>	}
>
>	chain mangle_PRE_policy_blocknet {
>		jump mangle_PRE_policy_blocknet_pre
>		jump mangle_PRE_policy_blocknet_log
>		jump mangle_PRE_policy_blocknet_deny
>		jump mangle_PRE_policy_blocknet_allow
>		jump mangle_PRE_policy_blocknet_post
>	}
>
>	chain mangle_PRE_policy_blocknet_pre {
>	}
>
>	chain mangle_PRE_policy_blocknet_log {
>	}
>
>	chain mangle_PRE_policy_blocknet_deny {
>	}
>
>	chain mangle_PRE_policy_blocknet_allow {
>	}
>
>	chain mangle_PRE_policy_blocknet_post {
>	}
>}

Actions: View

Attachments on bug 2216972: 1974292 | 1974390