Atualizar Confs/srv1/nftables.conf

Confs/srv1/nftables.conf

@@ -1,22 +1,43 @@
+
+#!/usr/sbin/nft -f
+
+flush ruleset
+
 table inet filter {
+
     chain input {
-		type filter hook input priority filter; policy accept;
+        type filter hook input priority 0;
+        policy accept;
     }
 
     chain forward {
-		type filter hook forward priority filter; policy accept;
+        type filter hook forward priority 0;
+        policy drop;
+
+        # Permite pacotes de conexões já estabelecidas
+        ct state established,related accept
+
+        # Permite a rede LAB acessar a Internet
+        iifname "enp0s8" oifname "enp0s3" accept
     }
 
     chain output {
-		type filter hook output priority filter; policy accept;
+        type filter hook output priority 0;
+        policy accept;
     }
 }
+
 table ip nat {
-	chain POSTROUTING {
+
-		type nat hook postrouting priority srcnat; policy accept;
+    chain postrouting {
-		oifname "enp0s3" counter packets 0 bytes 0 masquerade
+        type nat hook postrouting priority srcnat;
+        policy accept;
+
+        # NAT da rede LAB para a Internet
+        oifname "enp0s3" ip saddr 172.17.0.0/24 masquerade
     }
 
+
 	chain PREROUTING {
 		type nat hook prerouting priority dstnat; policy accept;
 		ip saddr 192.168.56.1 ip daddr 192.168.56.100 tcp dport 10001 counter packets 0 bytes 0 dnat to 172.17.0.2:22