Firewall Regeln für Travelrouter

#!/bin/bash

# Flush existing rules
iptables -F
iptables -t nat -F
iptables -X

# Default policy: Drop all incoming and forwarding traffic
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback interface
iptables -A INPUT -i lo -j ACCEPT

# Allow established and related connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# eth0: Admin interface - Allow SSH and RaspAP Web GUI
iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 443 -j ACCEPT

# wlan1: Hotspot interface - Allow internal communication
iptables -A INPUT -i wlan1 -j ACCEPT
iptables -A FORWARD -i wlan1 -o wlan0 -m conntrack --ctstate NEW -j ACCEPT

# wlan0: WAN interface - Allow outgoing, block incoming
iptables -A INPUT -i wlan0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i wlan0 -o wlan1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# Enable NAT (for hotspot internet access)
iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE

# Drop invalid packets
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

# Log dropped packets (optional)
iptables -A INPUT -m limit --limit 5/min -j LOG --log-prefix "iptables dropped: " --log-level 7  

# Save the rules
iptables-save > /etc/iptables/rules.v4

#!/bin/bash

# Configurable variables
ALLOWED_IP="192.168.1.100"  # Replace with your admin IP  

# Enable IP forwarding
sysctl -w net.ipv4.ip_forward=1

# Flush existing nftables rules
nft flush ruleset

# Create a new nftables ruleset
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; policy drop \; }
nft add chain inet filter forward { type filter hook forward priority 0 \; policy drop \; }
nft add chain inet filter output { type filter hook output priority 0 \; policy accept \; }

# Allow loopback interface
nft add rule inet filter input iif lo accept

# Allow established and related connections
nft add rule inet filter input ct state established,related accept

# Admin Interface (eth0): Allow SSH and RaspAP Web GUI from specific IP
nft add rule inet filter input iif eth0 ip saddr $ALLOWED_IP tcp dport {22, 80, 443} accept

# Hotspot Interface (wlan1): Allow internal communication
nft add rule inet filter input iif wlan1 accept
nft add rule inet filter forward iif wlan1 oif wlan0 ct state new accept

# Allow DNS and DHCP from hotspot (RaspAP services)
nft add rule inet filter input iif wlan1 udp dport {53, 67} accept

# WAN Interface (wlan0): Allow outgoing, block incoming
nft add rule inet filter input iif wlan0 ct state established,related accept
nft add rule inet filter forward iif wlan0 oif wlan1 ct state established,related accept

# Enable NAT for internet access through the hotspot
nft add table ip nat
nft add chain ip nat postrouting { type nat hook postrouting priority 100 \; }
nft add rule ip nat postrouting oif wlan0 masquerade

# Drop invalid packets
nft add rule inet filter input ct state invalid drop

# Log dropped packets (optional)
nft add rule inet filter input limit rate 5/min log prefix "nftables dropped: " level debug  

# Save the rules to a persistent file
nft list ruleset > /etc/nftables.conf

# Print success message
echo "Firewall rules and IP forwarding applied successfully using nftables."  

table inet filter {
        chain input {
                type filter hook input priority filter; policy drop;
                iif "lo" accept  
                ct state established,related accept
                iif "eth0" tcp dport { 22, 80, 443 } accept  
                iif "wlan1" accept  
                iif "wlan1" udp dport { 53, 67 } accept  
                iif "wlan0" ct state established,related accept  
                ct state invalid drop
                limit rate 5/minute log prefix "nftables dropped: " level debug  
        }

        chain forward {
                type filter hook forward priority filter; policy drop;
                iif "wlan1" oif "wlan0" ct state new accept  
                iif "wlan0" oif "wlan1" ct state established,related accept  
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
table ip nat {
        chain postrouting {
                type nat hook postrouting priority srcnat; policy accept;
                oif "wlan0" masquerade  
        }
}

# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
        chain INPUT {
                type filter hook input priority filter; policy accept;
        }

        chain FORWARD {
                type filter hook forward priority filter; policy accept;
                iifname "tun0" oifname "wlan1" ct state related,established counter packets 0 bytes 0 accept  
                iifname "wlan1" oifname "tun0" counter packets 0 bytes 0 accept  
        }

        chain OUTPUT {
                type filter hook output priority filter; policy accept;
        }
}
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
        chain PREROUTING {
                type nat hook prerouting priority dstnat; policy accept;
        }

        chain INPUT {
                type nat hook input priority 100; policy accept;
        }

        chain OUTPUT {
                type nat hook output priority -100; policy accept;
        }

        chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                counter packets 62 bytes 5889 masquerade
                ip saddr 192.168.50.0/24 ip daddr != 192.168.50.0/24 counter packets 0 bytes 0 masquerade
                oifname "tun0" counter packets 0 bytes 0 masquerade  
        }
}

#!/usr/sbin/nft -f
flush ruleset

table inet filter {
        chain input {
                type filter hook input priority filter; policy drop;
                iif "lo" accept    
                ct state established,related accept
                iif "eth0" tcp dport { 22, 80, 443 } accept    
                iif "wlan1" accept    
                iif "wlan1" udp dport { 53, 67 } accept    
                iif "wlan0" ct state established,related accept    
                ct state invalid drop
                limit rate 5/minute log prefix "nftables dropped: " level debug    
        }

        chain forward {
                type filter hook forward priority filter; policy drop;
                iif "wlan1" oif "wlan0" ct state new accept    
                iif "wlan0" oif "wlan1" ct state established,related accept    
        }

        chain output {
                type filter hook output priority filter; policy accept;
        }
}
table ip nat {
        chain postrouting {
                type nat hook postrouting priority srcnat; policy accept;
                oif "wlan0" masquerade    
        }
}