This is a nft file to whitelist rats, a simple way to allow known address to access server based functions.
table inet ratfilter {
set allowed_rats {
type ipv4_addr;
elements = { 102.134.243.0/24, 154.66.114.0/23, 102.213.4.230/31,
105.233.0.0/16, 102.213.4.0/22, 102.209.96.0/18,
102.219.109.0/25 }
}
chain input {
type filter hook input priority 0; policy accept;
# Allow established and related traffic
ct state established,related accept
# Accept TCP connections from allowed_rats on ports 30001-49999
ip saddr @allowed_rats tcp dport 30001-49999 accept
# Drop all other traffic on ports 30001-49999 from host0 interface
iifname "host0" tcp dport 30001-49999 drop
}
}
This nftables configuration defines a firewall rule set under the table inet ratfilter. Let’s break it down in detail:
1. Table Definition
inet ratfilter {
2. Set Definition (allowed_rats)
set allowed_rats {
type ipv4_addr;
elements = { 102.134.243.0/24, 154.66.114.0/23, 102.213.4.230/31,
105.233.0.0/16, 102.213.4.0/22, 102.209.96.0/18,
102.219.109.0/25 }
}
👉 Purpose:
- These IP addresses represent trusted/allowed sources that will be permitted to connect on certain ports.
chain input {
type filter hook input priority 0; policy accept;
chain input:
Defines a firewall chain named input, which processes incoming packets.
type filter → Specifies this is a filtering chain (not NAT or forwarding).
hook input → This means the rules apply to traffic destined for the local machine.
priority 0 → Specifies the order in which this chain is processed.
policy accept → The default action is accept, meaning traffic is allowed unless explicitly dropped.
ct state established,related accept
👉 Purpose:
- Without this rule, you might block legitimate responses (e.g., replies from websites or remote SSH servers).
5. Accept TCP Connections from allowed_rats on Ports 30001-49999
ip saddr @allowed_rats tcp dport 30001-49999 accept
ip saddr @allowed_rats:
- This matches packets only if the source IP is in the
allowed_rats set.
tcp dport 30001-49999:
- This restricts the rule to TCP traffic on ports 30001-49999.
accept:
- Allows the matching traffic.
👉 Purpose:
Only trusted IPs (allowed_rats) can connect to ports 30001-49999.
If an untrusted source tries to connect, it will be dropped (or follow the default policy).
6. Drop All Other Traffic on Ports 30001-49999 from Interface host0
iifname "host0" tcp dport 30001-49999 drop
👉 Purpose:
Wrap
Defines a firewall table (ratfilter) and a trusted IP set (allowed_rats).
Allows existing and related connections (important for stability).
Permits trusted IPs (allowed_rats) to connect to ports 30001-49999.
Blocks all traffic on ports 30001-49999 from host0 unless explicitly allowed.
🚀 Final Thought:
This configuration secures high-numbered ports while allowing only trusted sources to access them. It's a solid setup for protecting services running on non-standard TCP ports.
