# Discourse 설치 보안을 위한 Nftables 규칙

**URL:** https://meta.discourse.org/t/nftables-rules-for-hardening-discourse-installation/240591
**Category:** Self-hosting
**Created:** [10월 1, 2022, 6:58오후 UTC](https://meta.discourse.org/t/nftables-rules-for-hardening-discourse-installation/240591 "2022-10-01T18:58:53Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![OrkoGrayskull](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/orkograyskull/32/275883_2.png) [@OrkoGrayskull](https://meta.discourse.org/u/OrkoGrayskull)
#### Post date: [10월 2, 2022, 11:51오전 UTC](https://meta.discourse.org/t/nftables-rules-for-hardening-discourse-installation/240591/3 "2022-10-02T11:51:43Z")

</div>

이제 [해당 스레드](https://meta.discourse.org/t/will-ufw-limit-discourse-too/231873/12)를 읽고 직접 테스트를 해보았습니다. Docker는 자체 iptables 규칙을 포함하고 있으며, 설치 후 또는 docker 서비스가 (재)시작/로드될 때 이를 적용합니다:

`service docker restart`

이러한 규칙 세트가 없으면 Discourse 설치가 작동하지 않습니다. 즉: 컨테이너를 설치, 재빌드 또는 재시작할 때 이러한 규칙이 존재해야 합니다. 그렇지 않으면 다음과 같은 오류 메시지가 나타납니다:

```plaintext
Error response from daemon: driver failed programming external connectivity on endpoint app (e4d4d3cc812a11862ee6aaa6ab453e61b95da1e6d90f9a76a71959148d228476): (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 443 -j DNAT --to-destination 172.17.0.2:443 ! -i docker0: iptables: No chain/target/match by that name.
 (exit status 1))

```

그러나 Discourse 설치가 완료되거나 업데이트 후 컨테이너가 재시작되면, Docker 규칙은 더 이상 필요하지 않은 것으로 보입니다. 그 후 다음과 같은 nftables 규칙을 로드할 수 있습니다:

```plaintext
#!/usr/sbin/nft -f

#################### 
# Purge/Flush # 
#################### 
flush ruleset

#################### 
# Incoming Traffic # 
#################### 
table inet filter { 	    
   chain input { 		       
      type filter hook input priority 0; policy drop;
      
      # Allow loopback interface 		       
      iifname lo accept

      # Rate limit ICMPv4|ICMPv6 traffic       
      ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded, parameter-problem, router-solicitation, router-advertisement } limit rate over 5/second drop       
      ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, parameter-problem, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } limit rate over 5/second drop

      # Allow packets to established/related connections        
      ct state established,related accept         
  
      # Drop invalid connections        
      ct state invalid drop
      
      # Allow ICMPv4: Ping requests | Error messages | Router selection messages       
      ip protocol icmp icmp type { echo-request, echo-reply, destination-unreachable, time-exceeded, parameter-problem, router-solicitation, router-advertisement } accept              
   
      # Allow ICMPv6 traffic (https://tools.ietf.org/html/rfc4890#page-18)       
      ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, echo-request, parameter-problem, echo-reply, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert } accept

      # Allow SSH access on port 7777 [rate limit]       
      tcp dport 7777 ct state new limit rate 3/minute accept

      # Allow HTTP / HTTPS traffic
      tcp dport { http, https } accept
      
      # Reject other packets       
      ip protocol tcp reject with tcp reset
      ip6 nexthdr tcp reject with tcp reset    
   }
#################### 
# Forward Traffic # 
####################    
   chain forward { 		       
      type filter hook forward priority 0; policy drop; 	    
   } 
#################### 
# Outgoing Traffic # 
####################    
   chain output { 		       
      type filter hook output priority 0; policy accept;  	
      
      # Allow loopback interface 		       
      oifname lo accept	    
   } 
}

```

이제 또 다른 질문으로 이어집니다: 어떻게 해야 할까요?

---

_[View the full topic](https://meta.discourse.org/t/nftables-rules-for-hardening-discourse-installation/240591)._