From 82f9e5ac97e076d57b8502c920ac770a82879b9a Mon Sep 17 00:00:00 2001 From: Tomas Volf Date: Mon, 14 Aug 2023 01:21:33 +0200 Subject: [PATCH] services: nftables: Tighten the default rules. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Packets for local host IP ranges should be coming only over lo. If that is not the case, we should drop them. Use iif for the check instead of iifname, lo is guaranteed to exists, and iif is faster. * gnu/services/networking.scm (%default-nftables-ruleset): Tighten the rules. Signed-off-by: Ludovic Courtès --- gnu/services/networking.scm | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/gnu/services/networking.scm b/gnu/services/networking.scm index 99889e3072..0508a4282c 100644 --- a/gnu/services/networking.scm +++ b/gnu/services/networking.scm @@ -1813,7 +1813,10 @@ table inet filter { ct state { established, related } accept # allow from loopback - iifname lo accept + iif lo accept + # drop connections to lo not coming from lo + iif != lo ip daddr 127.0.0.1/8 drop + iif != lo ip6 daddr ::1/128 drop # allow icmp ip protocol icmp accept