# Discourse 설치 보안을 위한 Nftables 규칙 **URL:** \ **Category:** Self-hosting\ **Created:** [10월 1, 2022, 6:58오후 UTC](https://meta.discourse.org/t/nftables-rules-for-hardening-discourse-installation/240591 "2022-10-01T18:58:53Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![OrkoGrayskull](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/orkograyskull/32/275883_2.png) [@OrkoGrayskull](https://meta.discourse.org/u/OrkoGrayskull)\ **Post date:** [10월 1, 2022, 6:58오후 UTC](https://meta.discourse.org/t/nftables-rules-for-hardening-discourse-installation/240591/1 "2022-10-01T18:58:53Z")
안녕하세요 여러분, 여기서 처음 글을 올립니다. 제 배경은 다음과 같습니다. 저는 10년 이상 리눅스 서버를 관리해 왔습니다. 약 일주일 전, 서버(Debian Bullseye)에 Discourse를 설치했습니다. 지금까지 매우 마음에 듭니다! 이제 호스트 시스템(예: 웹 서버)에 일반적인 강화 조치들을 적용하고 싶었습니다. 여기에는 nftables 규칙 세트 등이 포함됩니다. 저는 일반적으로 다음 규칙들을 사용합니다: ```plaintext #!/usr/sbin/nft -f #################### # Purge/Flush # #################### flush ruleset #################### # Incoming Traffic # #################### table inet filter { chain input { type filter hook input priority 0; policy drop; # Allow loopback interface iifname lo accept # Rate limit ICMPv4|ICMPv6 traffic ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded, parameter-problem, router-solicitation, router-advertisement } limit rate over 5/second drop ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, parameter-problem, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } limit rate over 5/second drop # Allow packets to established/related connections ct state established,related accept # Drop invalid connections ct state invalid drop # Allow ICMPv4: Ping requests | Error messages | Router selection messages ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded, parameter-problem, router-solicitation, router-advertisement } accept # Allow ICMPv6 traffic (https://tools.ietf.org/html/rfc4890#page-18) ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, parameter-problem, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } accept # Allow SSH access on port 2222 [rate limit] tcp dport 2222 ct state new limit rate 3/minute accept # Allow HTTP / HTTPS traffic tcp dport { http, https } accept # Reject other packets ip protocol tcp reject with tcp reset ip6 nexthdr tcp reject with tcp reset } #################### # Forward Traffic # #################### chain forward { type filter hook forward priority 0; policy drop; } #################### # Outgoing Traffic # #################### chain output { type filter hook output priority 0; policy accept; # Allow loopback interface oifname lo accept } } ``` 그러나 활성화한 후 Discourse가 작동하지 않게 되었습니다. 패키지가 Discourse의 Docker 설치로 전달되지 않는 것 같습니다. 특히 다음 규칙이 문제일 가능성이 높습니다: ```plaintext #################### # Forward Traffic # #################### chain forward { type filter hook forward priority 0; policy drop; } ``` 하지만 이제 막 조정을 시작하기 전에, 이미 이 문제를 다뤄본 적이 있고 베이스 시스템에 대해 작동하는 방화벽 규칙이 있는 분이 있는지 여쭤보고 싶었습니다. 이러한 규칙들은 Docker 기반 Discourse 설치에 의미가 있을까요? 지금까지 저는 Docker에 대해 거의 다루어 본 적이 없습니다. 추가 정보입니다. 다음 방화벽 규칙들은 Docker(docker-ce)에 의해 자동으로 추가됩니다: ```plaintext table ip nat { chain DOCKER { iifname "docker0" counter packets 0 bytes 0 return iifname != "docker0" meta l4proto tcp tcp dport 443 counter packets 155 bytes 7070 dnat to 172.17.0.2:443 iifname != "docker0" meta l4proto tcp tcp dport 80 counter packets 128 bytes 6263 dnat to 172.17.0.2:80 } chain POSTROUTING { type nat hook postrouting priority srcnat; policy accept; oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 34 bytes 2188 masquerade meta l4proto tcp ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 443 counter packets 0 bytes 0 masquerade meta l4proto tcp ip saddr 172.17.0.2 ip daddr 172.17.0.2 tcp dport 80 counter packets 0 bytes 0 masquerade } chain PREROUTING { type nat hook prerouting priority dstnat; policy accept; fib daddr type local counter packets 11439 bytes 550595 jump DOCKER } chain OUTPUT { type nat hook output priority -100; policy accept; ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER } } table ip filter { chain DOCKER { iifname != "docker0" oifname "docker0" meta l4proto tcp ip daddr 172.17.0.2 tcp dport 443 counter packets 155 bytes 7070 accept iifname != "docker0" oifname "docker0" meta l4proto tcp ip daddr 172.17.0.2 tcp dport 80 counter packets 128 bytes 6263 accept } chain DOCKER-ISOLATION-STAGE-1 { iifname "docker0" oifname != "docker0" counter packets 588 bytes 44199 jump DOCKER-ISOLATION-STAGE-2 counter packets 1187 bytes 428425 return } chain DOCKER-ISOLATION-STAGE-2 { oifname "docker0" counter packets 0 bytes 0 drop counter packets 588 bytes 44199 return } chain FORWARD { type filter hook forward priority filter; policy drop; counter packets 1187 bytes 428425 jump DOCKER-USER counter packets 1187 bytes 428425 jump DOCKER-ISOLATION-STAGE-1 oifname "docker0" ct state related,established counter packets 316 bytes 370893 accept oifname "docker0" counter packets 283 bytes 13333 jump DOCKER iifname "docker0" oifname != "docker0" counter packets 588 bytes 44199 accept iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept } chain DOCKER-USER { counter packets 1187 bytes 428425 return } chain INPUT { type filter hook input priority filter; policy accept; } } ``` 감사합니다 --- _[View the full topic](https://meta.discourse.org/t/nftables-rules-for-hardening-discourse-installation/240591)._