1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
table inet firewall {
chain input {
# Drop all traffic by default.
type filter hook input priority filter; policy drop;
# Allow traffic from established connections, drop invalid.
ct state vmap { established: accept, related: accept, invalid: drop }
# Allow ping.
icmp type echo-request accept
# Allow loopback traffic.
iifname lo accept
# Allow
# - ssh, http and https (for mugam itself)
# - mumble for ragulkanth (5033)
# - ssh for ragulkanth (10101)
tcp dport {ssh, http, https, 5033, 10101} accept
# Allow dns and wireguard.
udp dport {domain, 51820} accept
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority dstnat;
# Forward ports to various services.
iifname eth0 tcp dport {smtp, smtps, submission, pop3s, xmpp-client, xmpp-server} dnat to $hrrol
}
chain postrouting {
type nat hook postrouting priority srcnat;
# For all packets to and from the VPN and the WAN, replace source
# address with public IP of WAN interface.
oifname {eth0, wg0} masquerade
}
}
|
