• 1 Post
  • 329 Comments
Joined 3 years ago
cake
Cake day: June 30th, 2023

help-circle









  • Update your nftables rulefile or use nft commands to update your firewall to the following:

    # extract
    chain OUT {
        type filter hook output priority 0; policy drop;
        udp dport 123 accept
    
        limit rate 3/second log prefix "Nftables Blocked: OUT: "
    }
    
    chain IN {
        type filter hook input priority 0; policy drop;
        ct state established, related accept
    
        limit rate 3/second log prefix "Nftables Blocked: IN: "
    }
    

    Blocked pakets will show up in the kernel log (dmesg/journalcl)

    If you want more information on why it is blocked then enable nftrace for those packets

    nft add rule inet/ip/ip6 tablename OUT udp dport 123 meta nftrace set 1
    nft add rule inet/ip/ip6 tablename IN udp dport 123 meta nftrace set 1
    nft monitor trace
    

    Or

    nft add rule inet/ip/ip6 tablename OUT meta nftrace set 1
    

    Or maybe even

    nft add rule inet/ip/ip6 tablename PREROUTING udp dport 123 meta nftrace set 1
    
    

    Additionally you can use tcpdump -i <interface> to show network packets before they enter the firewall, there you should be able to tell what it’s a trying to do.