# firewall

filter incoming traffic

The step owns the nftables table inet winch and changes no other table. The rules of Docker, fail2ban, or /etc/nftables.conf stay. Its input chain filters traffic to the host. Traffic that Docker forwards to a container passes the forward hook, so a port that Docker publishes stays open. Publish the port on 127.0.0.1 when only a local proxy reaches the container. A host has at most one firewall step in a run.

The step needs nft: install the package nftables in an earlier pkg step.

Every change gets the access check and the rollback of confirm\_access. When the access check fails after the new rules load, the old rules come back.

The check fails when a file of the step on the host, such as /etc/winch/firewall.nft, is larger than 1 MiB.

## Keys

| Key | Type | Default | Meaning |
| --- | --- | --- | --- |
| [`allow`](#firewall.allow) | list of maps | - | accepted traffic to the host; the host drops the rest |
| [`allow.tcp`](#firewall.allow.tcp) | integer or list of integers | - | ports |
| [`allow.udp`](#firewall.allow.udp) | integer or list of integers | - | ports |
| [`allow.from`](#firewall.allow.from) | string or list of strings | - | source addresses or networks |
| [`absent`](#firewall.absent) | boolean | false | remove the table, its file, and its unit |

### `firewall.allow` {#firewall.allow}

list of maps

Accepted traffic to the host; the host drops the rest. It always accepts established and related traffic, loopback, ICMP echo requests, the ICMPv6 types that IPv6 needs, and DHCP replies. It drops invalid packets.

### `firewall.allow.tcp` {#firewall.allow.tcp}

integer or list of integers

Ports. A rule has tcp or udp.

### `firewall.allow.udp` {#firewall.allow.udp}

integer or list of integers

Ports. A rule has tcp or udp.

### `firewall.allow.from` {#firewall.allow.from}

string or list of strings

Source addresses or networks. IPv4 and IPv6 are allowed. Without from, the rule accepts every source.

### `firewall.absent` {#firewall.absent}

boolean, default false

Remove the table, its file, and its unit.

## Example

```yaml
- firewall:
    allow:
      - tcp: [22, 80, 443]
      - udp: 51820
      - tcp: 5432
        from: [10.0.0.0/8, 2001:db8::/32]
```