Firewall nftables settings (firewall.toml)

[[ports]]
numbers = [22]
directions = ["in", "out"]
protocols = ["tcp"]
action = "accept"

[[ports]]
numbers = [80,443]
directions = ["in", "out"]
protocols = ["tcp"]
action = "accept"

[[ports]]
numbers = [53]
directions = ["in", "out"]
protocols = ["tcp", "udp"]
action = "accept"

[[ports]]
numbers = [22]
directions = ["in", "out"]
protocols = ["tcp"]
action = "accept"

[[ports]]
numbers = [22]
directions = ["in"]
protocols = ["tcp"]
action = "drop"

[[ports]]
numbers = [22]
directions = ["out"]
protocols = ["tcp"]
action = "accept"

[[ports]]
numbers = [80,443]
directions = ["in", "out"]
protocols = ["tcp"]
action = "accept"
limit_rate = "10/second"

We specify IP the addresses that should be allowed or prohibited. [[ips]] You can specify an unlimited number of groups.

[[ips]]
ips - List of IP addresses (required field)
directions - Incoming (in)and outgoing traffic (out) (required field)
action - Action: accept, drop or reject (required field)
ports - Port numbers (optional field)
protocols - Protocol: tcp, udp (optional field)
limit_rate - Specify restrictions if necessary (optional field)

ips - you can specify one or more IP addresses, but the rules will be created separately for each address.
ports - you can specify one or more ports, but the rules will be created separately for each port.
directions - if we specify in and out, then each rule is created separately in its own chain.
protocols - if and is specified tcp udp, then each rule is created separately for each protocol.

Attention:
If protocols not specified, but specified ports, the rules will be added with the protocol TCP. protocols works together with ports If protocols it is specified, but ports not, then a rule will be added without taking these fields into account.

action:
accept - allow
drop - block silently
reject - lock with feedback

limit_rate - install it according to the documentation nftables (limit rate).

[[ips]]
ips = ["192.168.1.1", "fe80::260:8ff:fe52:f9d8"]
action = "accept"
directions = ["in", "out"]
protocols = ["tcp", "udp"]
ports = ["80"]
limit_rate = "10/second"

[[ips]]
ips = ["192.168.1.2"]
action = "drop"
directions = ["in"]

[[ips]]
ips = ["192.168.1.2"]
action = "drop"
directions = ["in"]

icmp_in = true

icmp_in = false

icmp_in_rate = "1/second"

icmp_in_rate = "0"

icmp_in_rate = "3/second"

icmp_out = true

icmp_out = false

icmp_out_rate = "1/second"

icmp_out_rate = "0"

icmp_out_rate = "3/second"

icmp_timestamp_drop = true

icmp_timestamp_drop = false

enable = true

enable = false

icmp_strict = true

icmp_strict = false

cache = true

cache = false

Switching the firewall cleaning mode nftables. If you specify "own", there may be a conflict in the rules. It can cause a security problem. Please indicate "own" if you are confident in your actions.

global - clears all the rules completely
own - clears only the rules from the table that are specified in the parameter table_name

clear_mode = global

clear_mode = own

saves_rules = true

saves_rules = false

saves_rules_path = "/etc/nftables.conf"

dns_strict = true

dns_strict = false

dns_strict_ns = true

dns_strict_ns = false

packet_filter = true

packet_filter = false

default_allow_input = true

default_allow_input = false

default_allow_output = true

default_allow_output = false

default_allow_forward = true

default_allow_forward = false

input_drop = "drop"

input_drop = "reject"

input_priority = -10

input_priority = 0

output_drop = "drop"

output_drop = "reject"

output_priority = -10

output_priority = 0

forward_drop = "drop"

forward_drop = "reject"

forward_priority = -10

forward_priority = 0

This is a group of settings Port knocking. [[portKnocking]] You can specify an unlimited number of groups.

[[portKnocking]]
name - The name must be unique and characters are allowed.: a-z, A-Z, -, _
port - The port number that needs to be opened after all knocks
protocol - Protocol: tcp, udp
ip_version - Version IP: ip4,ip6
[[portKnocking.knock]] - knock
port - Knock port
protocol - Knock protocol: tcp, udp
timeout - The time in seconds for which the knock works
action - During a knock, which answer should I give: accept, return, drop or reject

[[portKnocking]]
name = "ssh"
port = 22
protocol = "tcp"
ip_version = "ip4"
[[portKnocking.knock]]
port = 2222
protocol = "tcp"
timeout = 30
action = "drop"
[[portKnocking.knock]]
port = 2225
protocol = "tcp"
timeout = 30
action = "drop"

[[portKnocking]]
name = "ftp"
port = 21
protocol = "tcp"
ip_version = "ip4"
[[portKnocking.knock]]
port = 2121
protocol = "tcp"
timeout = 30
action = "drop"

[[portKnocking]]
name = "ssh"
port = 22
protocol = "tcp"
ip_version = "ip4"
[[portKnocking.knock]]
port = 2222
protocol = "tcp"
timeout = 10
action = "drop"

[[portKnocking]]
name = "ssh"
port = 22
protocol = "tcp"
ip_version = "ip4"
[[portKnocking.knock]]
port = 2222
protocol = "tcp"
timeout = 30
action = "drop"
[[portKnocking.knock]]
port = 2225
protocol = "tcp"
timeout = 30
action = "drop"

[[portKnocking]]
name = "ftp"
port = 21
protocol = "tcp"
ip_version = "ip4"
[[portKnocking.knock]]
port = 2121
protocol = "tcp"
timeout = 30
action = "drop"
[[portKnocking.knock]]
port = 2122
protocol = "tcp"
timeout = 30
action = "drop"
[[portKnocking.knock]]
port = 2221
protocol = "tcp"
timeout = 30
action = "drop"

table_name = "shield"

chain_input_name = "input"

chain_output_name = "output"

chain_forward_name = "forward"