Webserver local keine Verbindung nach aussen: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
(Die Seite wurde neu angelegt: „=Konfig= *cat /etc/nftables.conf <pre> #!/usr/sbin/nft -f flush ruleset table inet filter { chain input { type filter hook input priority filter; } ch…“) |
(→Konfig) |
||
| Zeile 15: | Zeile 15: | ||
chain output { | chain output { | ||
type filter hook output priority filter; | type filter hook output priority filter; | ||
| + | ct state new meta skuid 33 ip dport 10.88.2XX.21 udp dport 53 accept | ||
| + | ct state new meta skuid 33 ip dport 10.88.2XX.21 tcp dport 53 accept | ||
ct state new meta skuid 33 log prefix "nft-drop-uid33: " drop | ct state new meta skuid 33 log prefix "nft-drop-uid33: " drop | ||
} | } | ||
} | } | ||
</pre> | </pre> | ||
| + | |||
=Enablen= | =Enablen= | ||
*systemctl enable nftables | *systemctl enable nftables | ||
Aktuelle Version vom 1. Oktober 2026, 11:40 Uhr
Konfig
- cat /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority filter;
}
chain forward {
type filter hook forward priority filter;
}
chain output {
type filter hook output priority filter;
ct state new meta skuid 33 ip dport 10.88.2XX.21 udp dport 53 accept
ct state new meta skuid 33 ip dport 10.88.2XX.21 tcp dport 53 accept
ct state new meta skuid 33 log prefix "nft-drop-uid33: " drop
}
}
Enablen
- systemctl enable nftables
Neu laden
- nft -f /etc/nftables.conf
Kontrolle
- journal -fkg nft-drop