feat(device-edge): open bounded tracker ingress

2026-08-12 15:10:27 +03:00
parent 6fd172ecc5
commit 606872edcc
9 changed files with 717 additions and 3 deletions
@@ -0,0 +1,27 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet nodedc_b2_vps {
+  chain input {
+    type filter hook input priority -10; policy drop;
+
+    iifname "lo" accept
+    ct state invalid drop
+    ct state established,related accept
+    ip protocol icmp accept
+    ip6 nexthdr ipv6-icmp accept
+
+    tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
+    tcp dport 443 ct state new limit rate 120/minute burst 120 packets accept
+    tcp dport 9921 ct state new limit rate 600/minute burst 128 packets accept
+  }
+
+  chain forward {
+    type filter hook forward priority -10; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority -10; policy accept;
+  }
+}