| # |
| # rules.before |
| # |
| # Rules that should be run before the ufw command line added rules. Custom |
| # rules should be added to one of these chains: |
| # ufw-before-input |
| # ufw-before-output |
| # ufw-before-forward |
| # |
| |
| # nat Table rules |
| *nat |
| :POSTROUTING ACCEPT [0:0] |
| |
| # Forward traffic from eth1 through eth0. |
| -A POSTROUTING -o eth0 -j MASQUERADE |
| |
| # Set up NAT for CDN services |
| -A POSTROUTING -o eth2 -j MASQUERADE |
| |
| # DNS safe browsing |
| {% if safe_browsing %} |
| {% for mac in safe_browsing %} |
| -A PREROUTING -i eth1 -m mac --mac-source {{ mac }} -p udp --dport 53 -j REDIRECT --to-port 5353 |
| -A PREROUTING -i eth1 -m mac --mac-source {{ mac }} -p tcp --dport 53 -j REDIRECT --to-port 5353 |
| {% endfor %} |
| {% endif %} |
| |
| # don't delete the 'COMMIT' line or these nat table rules won't be processed |
| COMMIT |
| |
| # Don't delete these required lines, otherwise there will be errors |
| *filter |
| :ufw-before-input - [0:0] |
| :ufw-before-output - [0:0] |
| :ufw-before-forward - [0:0] |
| :ufw-not-local - [0:0] |
| # End required lines |
| |
| # allow all on loopback |
| -A ufw-before-input -i lo -j ACCEPT |
| -A ufw-before-output -o lo -j ACCEPT |
| |
| # quickly process packets for which we already have a connection |
| -A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
| -A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
| -A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
| |
| # drop INVALID packets (logs these in loglevel medium and higher) |
| -A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny |
| -A ufw-before-input -m conntrack --ctstate INVALID -j DROP |
| |
| # ok icmp codes for INPUT |
| -A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT |
| -A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT |
| -A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT |
| -A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT |
| -A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT |
| |
| # ok icmp code for FORWARD |
| -A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT |
| -A ufw-before-forward -p icmp --icmp-type source-quench -j ACCEPT |
| -A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT |
| -A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT |
| -A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT |
| |
| # allow dhcp client to work |
| -A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT |
| |
| # |
| # ufw-not-local |
| # |
| -A ufw-before-input -j ufw-not-local |
| |
| # if LOCAL, RETURN |
| -A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN |
| |
| # if MULTICAST, RETURN |
| -A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN |
| |
| # if BROADCAST, RETURN |
| -A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN |
| |
| # all other non-local packets are dropped |
| -A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny |
| -A ufw-not-local -j DROP |
| |
| # allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above |
| # is uncommented) |
| -A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT |
| |
| # allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above |
| # is uncommented) |
| -A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT |
| |
| # don't delete the 'COMMIT' line or these rules won't be processed |
| COMMIT |