Fleet | Configure nftables loopback traffic

Scripts/

Configure nftables loopback traffic

Set up nftables rules to allow legitimate loopback traffic on the lo interface while dropping spoofed loopback packets from external interfaces.

Bash

#!/bin/bash
nft create table inet filter
nft create chain inet filter input { type filter hook input priority 0 \; }
nft create chain inet filter output { type filter hook output priority 0 \; }

# Then add the loopback rules:
nft add rule inet filter input iif lo accept
nft add rule inet filter output oif lo accept
nft add rule inet filter input ip saddr 127.0.0.0/8 counter drop
nft add rule inet filter input ip6 saddr ::1 counter drop

# To make rules persistent, save them:
nft list ruleset > /etc/nftables.conf
systemctl enable nftables