abrown38andClaude Opus 5.5
ebec2cfcca
A DNAT map (named or anonymous) becomes one port forward per element, named after the map; a verdict map becomes one rule per element, in place, with jumps inlined. A lookup matches one element at most, so the expanded rules do the same. A named map that can't be expanded (keyed by several fields) is left out with a note instead of a raw rule naming it, which nftables would refuse. Test fixture made with nft 1.1.3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
1.3 KiB
Plaintext
45 lines
1.3 KiB
Plaintext
table inet main { # handle 3
|
|
map portforwards { # handle 4
|
|
type inet_service : ipv4_addr . inet_service
|
|
elements = { 80 : 192.168.1.50 . 8080,
|
|
443 : 192.168.1.50 . 443 }
|
|
}
|
|
|
|
map hosts { # handle 5
|
|
type inet_service : ipv4_addr
|
|
elements = { 2222 : 192.168.1.60 }
|
|
}
|
|
|
|
map lan_services { # handle 6
|
|
type inet_service : verdict
|
|
elements = { 22 : accept,
|
|
23 : drop,
|
|
80 : jump web }
|
|
}
|
|
|
|
map pairs { # handle 7
|
|
type ipv4_addr . inet_service : verdict
|
|
elements = { 192.168.1.9 . 22 : accept }
|
|
}
|
|
|
|
chain web { # handle 1
|
|
ip saddr 192.168.1.0/24 accept # handle 8
|
|
}
|
|
|
|
chain prerouting { # handle 2
|
|
type nat hook prerouting priority dstnat; policy accept;
|
|
iifname "wan" dnat ip to tcp dport map @portforwards comment "Port forwards" # handle 9
|
|
iifname "wan" dnat ip to tcp dport map @hosts # handle 10
|
|
iifname "wan" dnat ip to udp dport map { 5000 : 192.168.1.70 . 5001, 6000 : 192.168.1.71 . 6000 } # handle 12
|
|
}
|
|
|
|
chain input { # handle 3
|
|
type filter hook input priority filter; policy drop;
|
|
ct state established,related accept # handle 13
|
|
iifname "lan" tcp dport vmap @lan_services # handle 14
|
|
iifname "wan" udp dport vmap { 53 : accept, 123 : drop } # handle 16
|
|
ip saddr vmap { 10.0.0.0/8 : accept, 192.0.2.1 : drop } # handle 18
|
|
ip saddr . tcp dport vmap @pairs # handle 19
|
|
}
|
|
}
|