From 1b79e7677b70fc570fef707d679ec16e4b17458c Mon Sep 17 00:00:00 2001 From: iceBear67 Date: Mon, 13 Jul 2026 16:52:17 +0800 Subject: [PATCH] block access to my LAN --- image/overlay/etc/nftables.nft | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/image/overlay/etc/nftables.nft b/image/overlay/etc/nftables.nft index e4be3fb..68ea898 100644 --- a/image/overlay/etc/nftables.nft +++ b/image/overlay/etc/nftables.nft @@ -70,6 +70,12 @@ table inet filter { chain forward { type filter hook forward priority 0; policy accept; + ip daddr 10.0.0.119 tcp dport {80, 443} accept + ip daddr 10.0.0.119 udp dport 443 accept + # block LAN access from containers. + ip daddr 10.0.0.0/24 drop + ip daddr 192.168.0.0/16 drop + ip daddr 172.16.0.0/12 drop } chain output { @@ -81,4 +87,4 @@ table inet filter { include "/var/lib/nftables/*.nft" # Rules -include "/etc/nftables.d/*.nft" \ No newline at end of file +include "/etc/nftables.d/*.nft"