28 lines
681 B
Plaintext
28 lines
681 B
Plaintext
#!/usr/sbin/nft -f
|
|
|
|
flush ruleset
|
|
|
|
table inet nodedc_b2_vps {
|
|
chain input {
|
|
type filter hook input priority -10; policy drop;
|
|
|
|
iifname "lo" accept
|
|
ct state invalid drop
|
|
ct state established,related accept
|
|
ip protocol icmp accept
|
|
ip6 nexthdr ipv6-icmp accept
|
|
|
|
tcp dport 22 ct state new limit rate 30/minute burst 60 packets accept
|
|
tcp dport 443 ct state new limit rate 120/minute burst 120 packets accept
|
|
tcp dport 9921 ct state new limit rate 600/minute burst 128 packets accept
|
|
}
|
|
|
|
chain forward {
|
|
type filter hook forward priority -10; policy drop;
|
|
}
|
|
|
|
chain output {
|
|
type filter hook output priority -10; policy accept;
|
|
}
|
|
}
|