Re: How can I block all traffic from an IP range, irrespective of origin, going to, or coming from, using nftables in Debian 10

[Jags <TheJags@xxxxxxxxxxxxxx>]

> not sure about nftables but with iptables i would just place the drop
> stuff for 123.0.0.0/8 in -t raw PREROUTING because it's before conntrack
> and consider place it in a ipset for the case the list becomes longer
> because then you have only one rule and a lightning fast hash-lookup no
> matter how much entries


Yes, I noticed CPU spikes, and removed drop/reject rules immediately. Thought I would re-enable these rules only when I run a torrent client.

So should I just add a new table "raw" (and place this table at the top):

xxxxxxxxx
table inet raw {
        chain prerouting {
                type filter hook prerouting priority 0; policy accept;
                ip saddr 123.0.0.0/8 counter drop
        }
        chain output {
                type filter hook output priority 0; policy accept;
                ip daddr 123.0.0.0/8 counter reject
        }
xxxxxxxxx


Now do I need POSTROUTING chain in there too?

>From Gentoo wiki for Nftables: https://wiki.gentoo.org/wiki/Nftables#Tables

"postrouting: This hook comes after the routing decision has been made, all packets leaving the machine hit this hook."


Thank you so much.





‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On Friday, October 4, 2019 1:06 PM, Reindl Harald <h.reindl@xxxxxxxxxxxxx> wrote:

> Am 04.10.19 um 14:21 schrieb :
>
> > Thank you so much.
> > Now do I need to have OUTPUT chain before INPUT chain? 'Coz all the examples I've seen so far had INPUT as the first chain.
>
> shouldn't matter at all because a packet can only be output or input and
> not both
>
> >                 # Early drop of invalid connections
> >                 ct state invalid drop
> >                 ct state established,related accept
> >
>
> switch both of them! you have far more packets from legit traffic than
> invalid ones and hence "established,related" should always be the first
> rule in any stateful filter with exceptions like the topic
>
>
> > Side question: Does order of the chains or tables matter... like on other PC, I have "table inet nat" with chains "prerouting/postrouting".
> > Here's my complete nftables.conf:
> > xxxxx
> > #!/usr/sbin/nft -f
> > flush ruleset
> > table inet filter {
> > chain input {
> > type filter hook input priority 0; policy drop;
> >
> >                 iifname lo accept
> >
> >
> > ---> ip saddr 123.0.0.0/8 counter drop
> >
> >                 # Early drop of invalid connections
> >                 ct state invalid drop
> >                 ct state established,related accept
> >
> >                 # ICMP & IGMP
> >                 ip saddr 192.168.0.0/16 icmp type echo-request counter accept
> >                 icmp type echo-request counter drop
> >                 ip protocol igmp drop
> >
> >                 # ssh for internal network
> >                 ip saddr 192.168.0.0/16 tcp dport 22 counter accept
> >
> >                 # Avoid brute force on ssh
> >                 tcp dport 22 ct state new limit rate 10/minute accept
> >
> >                 # VsFTPD
> >                 ip saddr 192.168.0.0/16 tcp dport 20 counter accept
> >                 ip saddr 192.168.0.0/16 tcp dport 21 counter accept
> >                 ip saddr 192.168.0.0/16 tcp dport 990 counter accept
> >                 ip saddr 192.168.0.0/16 tcp dport 40000-50000 counter accept
> >
> >                 ct state new drop
> >                 # Everything else
> >                 drop
> >
> >                 log flags all counter drop
> >                 log prefix "[nftables] Input Denied: " flags all counter drop
> >     }
> >         chain output {
> >                 type filter hook output priority 0; policy accept;
> >
> >
> > ---> ip daddr 123.0.0.0/8 counter reject
> > }
> > }