table inet filter {
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
iif "lo" accept
ct state invalid drop
ip protocol icmp accept
ip protocol igmp accept
tcp dport ssh accept comment "SSH"
udp dport { netbios-ns, netbios-dgm } accept comment "Samba udp ports"
tcp dport { netbios-ssn, microsoft-ds } accept comment "Samba tcp ports"
tcp dport { 35621, 35623, 55413-55415 } accept comment "UrBackup tcp ports"
udp dport { 35621, 35622, 35623 } accept comment "UrBackup udp ports"
tcp dport 9090 accept comment "Cockpit Web Interface"
udp dport tftp accept comment "tftp"
tcp dport { ftp-data, ftp } accept comment "ftp"
}
}
table ip nat {
chain post {
type nat hook postrouting priority 100; policy accept;
ip saddr 192.168.1.2 oif "enp2s0.103" snat to 10.14.1.58
ip saddr 192.168.1.4 oif "enp2s0.103" snat to 10.14.1.58
ip saddr 192.168.1.6 oif "enp2s0.103" snat to 10.14.1.58
ip saddr 192.168.1.7 oif "enp2s0.103" snat to 10.14.1.58
}
chain forward {
type filter hook forward priority 0; policy drop;
ct state established,related accept
ip saddr 192.168.1.2 oif "enp2s0.103" accept
ip saddr 192.168.1.4 oif "enp2s0.103" accept
ip saddr 192.168.1.6 oif "enp2s0.103" accept
ip saddr 192.168.1.7 oif "enp2s0.103" accept
}
}
table inet filter {
chain input {
type filter hook input priority 0; policy drop;
ct state established,related accept
iif "lo" accept
ct state invalid drop
ip protocol icmp accept
ip protocol igmp accept
tcp dport ssh accept comment "SSH"
udp dport { netbios-ns, netbios-dgm } accept comment "Samba udp ports"
tcp dport { netbios-ssn, microsoft-ds } accept comment "Samba tcp ports"
tcp dport { 35621, 35623, 55413-55415 } accept comment "UrBackup tcp ports"
udp dport { 35621, 35622, 35623 } accept comment "UrBackup udp ports"
tcp dport 9090 accept comment "Cockpit Web Interface"
udp dport tftp accept comment "tftp"
tcp dport { ftp-data, ftp } accept comment "ftp"
}
chain output {
type filter hook output priority 0; policy accept;
}
}
table ip nat {
chain post {
type nat hook postrouting priority 100; policy drop;
ip saddr 192.168.1.2 oif "enp2s0.103" snat to 10.14.1.58
ip saddr 192.168.1.4 oif "enp2s0.103" snat to 10.14.1.58
ip saddr 192.168.1.6 oif "enp2s0.103" snat to 10.14.1.58
ip saddr 192.168.1.7 oif "enp2s0.103" snat to 10.14.1.58
}
chain forward {
type filter hook forward priority 0; policy drop;
ct state established,related accept
ip saddr 192.168.1.2 oif "enp2s0.103" accept
ip saddr 192.168.1.4 oif "enp2s0.103" accept
ip saddr 192.168.1.6 oif "enp2s0.103" accept
ip saddr 192.168.1.7 oif "enp2s0.103" accept
}
}
Можно еще применять хэш-теги с помощью #