renken/shione
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

config: shione: nftables: srt input/output

Browse source 
Accept incoming UDP packets over VPN, allow incoming and outgoing SRT
connections over both public network and VPN.
This commit is contained in:
Renken 2024-01-06 12:25:31 +01:00
parent 59feba0fcc
commit 1d54e783ae
Signed by: renken
GPG key ID: 1F2BB159B645E575
1 changed files with 12 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
config/shione/nftables/files/etc/nftables.conf
View file

@ -5,6 +5,9 @@ flush ruleset
define eth_iface = enp1s0 define eth_iface = enp1s0
define wg_iface = wg0 define wg_iface = wg0
define wg_port = 51820 define wg_port = 51820
define dns_port = 53
define srt_input_udp_port = 60001
define srt_output_port = 60000
table inet filter { table inet filter {
chain input_ipv4 { chain input_ipv4 {
@ -36,8 +39,11 @@ table inet filter {
# ip saddr 10.8.0.0/32 # ip saddr 10.8.0.0/32
# Allow VPN to use DNS. # Allow VPN to use DNS.
tcp dport { 53 } accept tcp dport { $dns_port } accept
udp dport { 53 } accept udp dport {
$dns_port,
$srt_input_udp_port,
} accept
} }
chain input { chain input {
@ -58,6 +64,10 @@ table inet filter {
https, https,
} accept } accept
udp dport {
$srt_output_port,
} accept
# allow loopback traffic, anything else jump to chain for further evaluation # allow loopback traffic, anything else jump to chain for further evaluation
iifname vmap { lo : accept, $eth_iface : jump input_world, $wg_iface : jump input_vpn } iifname vmap { lo : accept, $eth_iface : jump input_world, $wg_iface : jump input_vpn }