Atualizar Confs/srv1/nftables.conf

Confs/srv1/nftables.conf

@@ -1,21 +1,42 @@
+
+#!/usr/sbin/nft -f
+
+flush ruleset
+
 table inet filter {
-	chain input {
-		type filter hook input priority filter; policy accept;
-	}
 
-	chain forward {
+    chain input {
-		type filter hook forward priority filter; policy accept;
+        type filter hook input priority 0;
-	}
+        policy accept;
+    }
 
-	chain output {
+    chain forward {
-		type filter hook output priority filter; policy accept;
+        type filter hook forward priority 0;
-	}
+        policy drop;
+
+        # Permite pacotes de conexões já estabelecidas
+        ct state established,related accept
+
+        # Permite a rede LAB acessar a Internet
+        iifname "enp0s8" oifname "enp0s3" accept
+    }
+
+    chain output {
+        type filter hook output priority 0;
+        policy accept;
+    }
 }
+
 table ip nat {
-	chain POSTROUTING {
+
-		type nat hook postrouting priority srcnat; policy accept;
+    chain postrouting {
-		oifname "enp0s3" counter packets 0 bytes 0 masquerade
+        type nat hook postrouting priority srcnat;
-	}
+        policy accept;
+
+        # NAT da rede LAB para a Internet
+        oifname "enp0s3" ip saddr 172.17.0.0/24 masquerade
+    }
+
 
 	chain PREROUTING {
 		type nat hook prerouting priority dstnat; policy accept;