6b74cf61df
- Конфиги сервера (Ubuntu) и клиента (Raspberry Pi 4): wg0.conf, systemd-сервисы udp2raw, nftables - README с инструкцией по развёртыванию и генерации ключей - .gitignore: исключены бинарный архив udp2raw и генерируемые *.key - .gitattributes: LF для всех Linux-конфигов (.conf/.service/.sh)
53 lines
1.9 KiB
Plaintext
53 lines
1.9 KiB
Plaintext
# RASPBERRY PI 4: /etc/nftables.conf
|
|
|
|
table ip nat {
|
|
chain postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
ip saddr 192.168.77.0/24 oifname "usbnet" masquerade
|
|
|
|
ip saddr 192.168.77.0/24 oifname "wg0" masquerade
|
|
}
|
|
}
|
|
table inet filter {
|
|
chain input {
|
|
type filter hook input priority filter; policy drop;
|
|
ct state established,related accept
|
|
iifname "lo" accept
|
|
ip protocol icmp accept
|
|
ip6 nexthdr ipv6-icmp accept
|
|
tcp dport 22 accept
|
|
iifname "wlan0" udp dport { 67, 68 } accept
|
|
iifname "wlan0" udp dport 53 accept
|
|
tcp dport 8080 accept
|
|
|
|
iifname "wg0" accept
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority filter; policy drop;
|
|
iifname "wlan0" oifname "usbnet" accept
|
|
iifname "usbnet" oifname "wlan0" ct state established,related accept
|
|
|
|
iifname "wlan0" oifname "wg0" accept
|
|
iifname "wg0" oifname "wlan0" ct state established,related accept
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority filter; policy accept;
|
|
}
|
|
}
|
|
table ip nm-shared-wlan0 {
|
|
chain nat_postrouting {
|
|
type nat hook postrouting priority srcnat; policy accept;
|
|
ip saddr 192.168.77.0/24 ip daddr != 192.168.77.0/24 masquerade
|
|
}
|
|
|
|
chain filter_forward {
|
|
type filter hook forward priority filter; policy accept;
|
|
ip daddr 192.168.77.0/24 oifname "wlan0" ct state { established, related } accept
|
|
ip saddr 192.168.77.0/24 iifname "wlan0" accept
|
|
iifname "wlan0" oifname "wlan0" accept
|
|
iifname "wlan0" reject
|
|
oifname "wlan0" reject
|
|
}
|
|
} |