nftables: minor firewalling improvements

ShellCode33 · ShellCode33 · commit b7366a915d5b · 2025-04-15T02:11:08.000+02:00
diff --git a/rootfs/etc/nftables.conf b/rootfs/etc/nftables.conf
@@ -5,7 +5,9 @@ flush ruleset
 table inet filter {
   chain input {
     type filter hook input priority 0; policy drop;
-    ct state invalid drop comment "early drop of invalid packets"
+    ct state invalid counter drop comment "early drop of invalid packets"
+
+    # https://googleprojectzero.blogspot.com/2015/01/finding-and-exploiting-ntpd.html
     iif lo accept comment "accept loopback"
     iif != lo ip daddr 127.0.0.1/8 counter drop comment "drop connections to loopback not coming from loopback"
     iif != lo ip6 daddr ::1/128 counter drop comment "drop connections to loopback not coming from loopback"
@@ -15,7 +17,7 @@ table inet filter {
     ip protocol icmp icmp type echo-request counter drop
 
     # Accept already established/related connections
-    ct state {established, related} accept comment "accept all connections related to connections made by us"
+    ct state {established, related} counter accept comment "accept all connections related to connections made by us"
 
     # Accept ICMP (ipv4 only)
     ip protocol icmp counter accept comment "allow ICMPv4 packets"
@@ -24,6 +26,7 @@ table inet filter {
     udp sport 67 udp dport 68 counter accept comment "allow DHCP traffic over UDP"
 
     # libvirt related config
+    iifname "virbr*" tcp dport 53 counter accept comment "allow VMs to reach the host's DNS server (dnsmasq)"
     iifname "virbr*" udp dport 53 counter accept comment "allow VMs to reach the host's DNS server (dnsmasq)"
     iifname "virbr*" udp dport 67 counter accept comment "allow VMs to reach the host's DHCP server (dnsmasq)"
 
