Disce aut Discede
Add post
given this global nftables configuration:
$ cat /etc/nftables.conf
#!/usr/sbin/nft -f
flush ruleset
table inet filter {
chain input {
type filter hook input priority 0;
}
chain forward {
type filter hook forward priority 0;
}
chain output {
type filter hook output priority 0;
}
}
include "/etc/nftables.d/*.conf"
create this local configuration snippet:
$ cat /etc/nftables.d/blackhole.conf
#!/usr/sbin/nft -f
table inet blackhole {
set clients {
type ipv4_addr
size 65536
flags interval,timeout
}
chain input {
type filter hook input priority -10; policy accept;
iifname "lo" return
iifname "disce" return
ip saddr @clients counter drop
}
}
use this script to list/add/remove space-separated prefixes (IPs or subnets) from that blackhole rule:
#!/bin/bash
ACTION="add"
if [[ $# -lt 1 ]] ; then
echo '$0 [-a|-d|-l] ip ip ... ip'
exit 0
fi
if [[ $1 == "-a" ]] ; then
ACTION="add"
shift
fi
if [[ $1 == "-d" ]] ; then
ACTION="delete"
shift
fi
if [[ $1 == "-l" ]] ; then
nft list set inet blackhole clients
exit 0
fi
while test $# -gt 0
do
nft ${ACTION} element inet blackhole clients { $1 }
shift
done