Atualizar Confs/srv1/nftables.conf

2026-09-19 13:46:59 +00:00
parent a78eed4604
commit 171d983069
1 changed files with 34 additions and 13 deletions
@@ -1,21 +1,42 @@
+
+#!/usr/sbin/nft -f
+
+flush ruleset
+
 table inet filter {
-	chain input {
-		type filter hook input priority filter; policy accept;
-	}

-	chain forward {
-		type filter hook forward priority filter; policy accept;
-	}
+    chain input {
+        type filter hook input priority 0;
+        policy accept;
+    }

-	chain output {
-		type filter hook output priority filter; policy accept;
-	}
+    chain forward {
+        type filter hook forward priority 0;
+        policy drop;
+
+        # Permite pacotes de conexões já estabelecidas
+        ct state established,related accept
+
+        # Permite a rede LAB acessar a Internet
+        iifname "enp0s8" oifname "enp0s3" accept
+    }
+
+    chain output {
+        type filter hook output priority 0;
+        policy accept;
+    }
 }
+
 table ip nat {
-	chain POSTROUTING {
-		type nat hook postrouting priority srcnat; policy accept;
-		oifname "enp0s3" counter packets 0 bytes 0 masquerade
-	}
+
+    chain postrouting {
+        type nat hook postrouting priority srcnat;
+        policy accept;
+
+        # NAT da rede LAB para a Internet
+        oifname "enp0s3" ip saddr 172.17.0.0/24 masquerade
+    }
+

 	chain PREROUTING {
 		type nat hook prerouting priority dstnat; policy accept;