I'm a new to nftables utility, could someone help me how can I write nftables rules based on the following iptables rulles:
iptables -I INPUT 2 -p tcp —tcp-flags ALL NONE -j DROP
iptables -I INPUT 3 -p tcp —tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -I INPUT 4 -p tcp —tcp-flags SYN,RST SYN,RST -j DROP
iptables -I INPUT 5 -p tcp —tcp-flags FIN,RST FIN,RST -j DROP
iptables -I INPUT 6 -p tcp —tcp-flags ACK,FIN FIN -j DROP
iptables -I INPUT 7 -p tcp —tcp-flags ACK,PSH PSH -j DROP
iptables -I INPUT 8 -p tcp —tcp-flags ACK,URG URG -j DROP
iptables -I INPUT 9 -p tcp -m tcp —tcp-flags FIN,ACK FIN -j DROP
iptables -I INPUT 10 -p tcp -m tcp —tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
iptables -I INPUT 11 -p tcp -m tcp —tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -I INPUT 12 -m psd -j DROP
what kind of nftables pakages should I've to install to support it? And what kind of changes and where in openwrt I should do to complete an issue properly? Please
If you want to/need to have wan open but still drop (most) of these packets, a simple invalid does the same.
I would recommend the add a counter and see how much of these tragic do you actually will get. My experience is, it rather rare these days.
Just a remark, the default action in the FW for external traffic from internet, is REJECT, you can change it to DROP.
And you can't really "prohibit" port scans, you can only modify your routers action, when they happen.
as @frollic noted, changing the WAN Zone Input to DROP would solve a need for these rules
you should reduce your rules to UCI firewall syntax in the future, so you don't have to translate them into underlying iptables/nft commands
All your TCP rules could be made into one: "drop new inbound TCP that != SYN" - just FYI (I previously used such a rule on OpenWrt versions based on iptabled
These kinds of bogus, martian and Christmas tree packets are rare. Most in my experiences today are port scans for real services and related reflected traffic desiged to amplify to other DSTs.
So, there are a bunch of goals what I'm pursuing. Such as, to be learned work with the rules, understanding and sharping skills in a syntax, and of course to protect myself.
