firewall

filter incoming traffic

The step owns the nftables table inet winch and changes no other table. The rules of Docker, fail2ban, or /etc/nftables.conf stay. Its input chain filters traffic to the host. Traffic that Docker forwards to a container passes the forward hook, so a port that Docker publishes stays open. Publish the port on 127.0.0.1 when only a local proxy reaches the container. A host has at most one firewall step in a run.

The step needs nft: install the package nftables in an earlier pkg step.

Every change gets the access check and the rollback of confirm_access. When the access check fails after the new rules load, the old rules come back.

The check fails when a file of the step on the host, such as /etc/winch/firewall.nft, is larger than 1 MiB.

Keys

Key	Type	Default	Meaning
`allow`	list of maps	-	accepted traffic to the host; the host drops the rest
`allow.tcp`	integer or list of integers	-	ports
`allow.udp`	integer or list of integers	-	ports
`allow.from`	string or list of strings	-	source addresses or networks
`absent`	boolean	false	remove the table, its file, and its unit

`firewall.allow`

list of maps

Accepted traffic to the host; the host drops the rest. It always accepts established and related traffic, loopback, ICMP echo requests, the ICMPv6 types that IPv6 needs, and DHCP replies. It drops invalid packets.

`firewall.allow.tcp`

integer or list of integers

Ports. A rule has tcp or udp.

`firewall.allow.udp`

integer or list of integers

Ports. A rule has tcp or udp.

`firewall.allow.from`

string or list of strings

Source addresses or networks. IPv4 and IPv6 are allowed. Without from, the rule accepts every source.

`firewall.absent`

boolean, default false

Remove the table, its file, and its unit.

Example

- firewall:
    allow:
      - tcp: [22, 80, 443]
      - udp: 51820
      - tcp: 5432
        from: [10.0.0.0/8, 2001:db8::/32]