Firewall

# systemctl enable nftables

# !/usr/sbin/nft -f

flush ruleset

# IPs SERVIDOR
# Defina o(s) IPv4/6(s) da interface do servidor
define IPV4_SERV = { 200.200.200.200 } 
define IPV6_SERV = { 2001:db8:1::cafe } 

# Portas aberta para TODOS
define PORTS_ACCEP_PUB = { 0 } # Defina a(s) portas que deseja deixar aberta o mundo

# Defina a(s) portas que serão restritas apeas as listas 
# ACESSO_TOTAL4 e ACESSO_TOTAL6 (Não esqueça de incluir as portas que vão receber o fluxos ex.: 3055, 3056, 3057)
define PORTS_ACCEP_ADM = { 5000, 3000, 22, 3055, 3056, 3057 } 

table inet filter {

    set ACESSO_TOTAL4 {
        type ipv4_addr
        flags interval
        elements = {
            127.0.0.0/8,
            192.168.0.0/24
        }
    }
    set ACESSO_TOTAL6 {
        type ipv6_addr
        flags interval
        elements = {
            ::1,
            aaaa:aaaa:aaaa::/48
        }
    }

    chain input {
        type filter hook input priority 0;

        # Aceita ICMP apenas das Origens com permissão
        ip saddr @ACESSO_TOTAL4 ip protocol icmp icmp type echo-request accept
        ip6 nexthdr icmpv6 ip6 saddr @ACESSO_TOTAL6 icmpv6 type echo-request accept

        # PERMITE PORTAS ACESSO PUBLICO
        ip  saddr 0.0.0.0/0 ip daddr { $IPV4_SERV } tcp dport { $PORTS_ACCEP_PUB } counter accept
        ip  saddr 0.0.0.0/0 ip daddr { $IPV4_SERV } udp dport { $PORTS_ACCEP_PUB } counter accept
        ip6 saddr ::/0 ip6 daddr { $IPV6_SERV } tcp dport { $PORTS_ACCEP_PUB } counter accept
        ip6 saddr ::/0 ip6 daddr { $IPV6_SERV } udp dport { $PORTS_ACCEP_PUB } counter accept

        # Permite acesso as portas em todos IPs vindo das origens permitidas
        ip  saddr @ACESSO_TOTAL4 tcp dport { $PORTS_ACCEP_ADM } counter accept
        ip  saddr @ACESSO_TOTAL4 udp dport { $PORTS_ACCEP_ADM } counter accept
        ip6 saddr @ACESSO_TOTAL6 tcp dport { $PORTS_ACCEP_ADM } counter accept
        ip6 saddr @ACESSO_TOTAL6 udp dport { $PORTS_ACCEP_ADM } counter accept

        # Fecha todo resto
        ip  daddr { $IPV4_SERV } ct state related,established counter accept
        ip  daddr { $IPV4_SERV } counter drop
        ip6 daddr { $IPV6_SERV } ct state related,established counter accept
        ip6 daddr { $IPV6_SERV }  counter drop

        type filter hook input priority 0;
    }
    chain forward {
        type filter hook forward priority 0;
    }
    chain output {
        type filter hook output priority 0;
    }
}

# systemctl restart nftables