steel: Add nftables firewall.

1 files changed, 12 insertions, 0 deletions

diff --git a/steel-nftables.conf b/steel-nftables.conf
new file mode 100644
index 0000000..e5d379c
--- /dev/null
+++ b/steel-nftables.conf
@@ -0,0 +1,12 @@
+table ip filter {
+  chain input {
+    # Drop all traffic by default.
+    type filter hook input priority 0; policy drop;
+    # Allow traffic from established connections.
+    ct state vmap { established: accept, related: accept, invalid: drop }
+    # Allow loopback traffic.
+    iifname lo accept
+    # Allow 8080 for occasional darkhttpd use.
+    tcp dport 8080 accept
+  }
+}
\ No newline at end of file