Red Hat Enterprise Linux 9 のファイアウォール（nftables）設定

define admin = {
        198.51.100.21,  # 自宅
        203.0.113.1     # 会社
}

#!/usr/bin/bash

LIST=/etc/nftables/list/domestic

mkdir -p /etc/nftables/list
cd /etc/nftables/list
wget http://nami.jp/ipv4bycc/cidr.txt.gz
gunzip cidr.txt.gz
echo "define domestic = {" > ${LIST}
for COUNTRY in 'JP'
do
    sed -n "s/^JP\t//p" cidr.txt | while read ADDRESS
    do
        echo "        ${ADDRESS}," >> ${LIST}
    done
done
echo "}" >> ${LIST}
rm cidr.txt

# 現在のルールセットを消去
flush ruleset

# 管理者用IPアドレスリストを読み込む
include "/etc/nftables/list/admin"
# 日本国内IPアドレスリストを読み込む
include "/etc/nftables/list/domestic"

table inet filter {

        set admin {
                type ipv4_addr
                elements = $admin
        }

        set domestic {
                type ipv4_addr
                flags interval
                elements = $domestic
        }

        chain input {
                type filter hook input priority 0; policy drop;

                # Ping floods
                ip protocol icmp icmp type echo-request limit rate 10/second accept

                # 関連・確立済みトラフィックは許可する
                ct state established,related accept

                # 不正なトラフィックは全て破棄する
                ct state invalid drop

                # ループバックインターフェイスのトラフィックは全て許可する
                iif lo accept

                # 新しいエコー要求 (ping) は許可する
                ip protocol icmp icmp type echo-request ct state new accept

                ip protocol udp ct state new jump UDP
                ip protocol tcp tcp flags & (fin | syn | rst | ack) == syn ct state new jump TCP

                # 他のルールによって処理されなかったトラフィックは全て拒否する
                ip protocol udp reject
                ip protocol tcp reject with tcp reset
        }

        chain forward {
                type filter hook forward priority 0; policy drop;
        }

        chain output {
                type filter hook output priority 0; policy accept;
        }

        chain TCP {
                # 管理者にのみ解放
                # ssh, OLS 管理画面
                tcp dport { 22, 7080 } ip saddr @admin accept

                # 日本国内にのみ開放
                # SMTPS, IMAPS
                tcp dport { 465, 993 } ip saddr @domestic accept

                # 全開放
                # SMTP, HTTP, HTTPS
                tcp dport { 25, 80, 443 } accept
        }

        chain UDP {
                # 全開放
                # http/3
                #udp dport { 443 } accept
        }

}

#include "/etc/nftables/main.nft"
include "/etc/nftables/filter.nft"

# nft list ruleset
table inet filter {
        set admin {
                type ipv4_addr
                elements = { 198.51.100.21, 203.0.113.1 }
        }

        set domestic {
                type ipv4_addr
                flags interval
                elements = { 1.0.16.0/20, 1.0.64.0/18,

                             ...

                             223.252.64.0/19, 223.252.112.0/20 }
        }

        chain input {
                type filter hook input priority filter; policy drop;
                ip protocol icmp icmp type echo-request limit rate 4/second accept
                ct state established,related accept
                iif "lo" accept
                ct state invalid drop
                ip protocol icmp icmp type echo-request ct state new accept
                ip protocol udp ct state new jump UDP
                ip protocol tcp tcp flags & (fin | syn | rst | ack) == syn ct state new jump TCP
                ip protocol udp reject
                ip protocol tcp reject with tcp reset
                meta nfproto ipv4 counter packets 0 bytes 0 reject with icmp type prot-unreachable
        }

        chain forward {
                type filter hook forward priority filter; policy drop;
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }

        chain TCP {
                tcp dport { 22, 7080 } ip saddr @admin accept
                tcp dport { 465, 993 } ip saddr @domestic accept
                tcp dport { 25, 80, 443 } accept
        }

        chain UDP {
        }
}

[DEFAULT]
# nftables を使用
banaction = nftables-multiport
banaction_allports = nftables-allports
# 試行回数
maxretry = 3
# 監視スパン
findtime = 1h
# 隔離時間
bantime = 1d
# アラートメールの通知先
destemail = root@example.com
# アラートメールの送信元
sender = fail2ban@example.com
# BANしてWhois情報とログ情報をメール通知
action = %(action_mwl)s
# 除外リスト（半角スペース区切り）
ignoreip = 198.51.100.21 203.0.113.1 

[sshd]
enabled = true

[recidive]
enabled = true

### Editing /etc/systemd/system/fail2ban.service.d/override.conf
### Anything between here and the comment below will become the new contents of the file

[Unit]
Requires=nftables.service
PartOf=nftables.service

[Install]
WantedBy=multi-user.target nftables.service

### Lines below this comment will be discarded

### /etc/systemd/system/fail2ban.service
# [Unit]
# Description=Fail2Ban Service
# Documentation=man:fail2ban(1)
# After=network.target iptables.service firewalld.service ip6tables.service ipset.service nftables.service
# PartOf=firewalld.service
#
# [Service]
# Type=simple
# Environment="PYTHONNOUSERSITE=1"
# ExecStartPre=/bin/mkdir -p /run/fail2ban
# ExecStart=/usr/bin/fail2ban-server -xf start
# # if should be logged in systemd journal, use following line or set logtarget to sysout in fail2ban.local
# # ExecStart=/usr/bin/fail2ban-server -xf --logtarget=sysout start
# ExecStop=/usr/bin/fail2ban-client stop
# ExecReload=/usr/bin/fail2ban-client reload
# PIDFile=/run/fail2ban/fail2ban.pid
# Restart=on-failure
# RestartPreventExitStatus=0 255
#
# [Install]
# WantedBy=multi-user.target