Skip to content

Generate include file with set of all Cloudflare IPv4 and IPv6 subnets

License

Notifications You must be signed in to change notification settings

makhomed/nftables-tool

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

22 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

nftables-tool (version 1.2.4)

Generate /etc/sysconfig/nftables-allowed-ipv4.conf and /etc/sysconfig/nftables-allowed-ipv6.conf

By default, include to list of allowed IPv4 addresses only Cloudflare IPv4 addresses.

By default, include to list of allowed IPv6 addresses only Cloudflare IPv6 addresses.

But, also it is possible to add extra IPv4 and/or IPv6 subnets in CIDR notation via command line.

See contrib/nftables.conf for example of usage of these generated ipv4_addr / ipv6_addr sets.

See also the nginx-cloudflare, which can be used instead of nftables-tool, if the Linux server must simultaneously allow two types of connections - both direct connections from clients and connections only from Cloudflare networks - in this case, filtering can be applied only at the nginx level, through the geo module.

Installation

Important

Python 3.8+ and Jinja2, requests, invoke modules required

dnf -y install python3 python3-pip ; \
python3 -m pip install --no-input --upgrade-strategy eager --upgrade Jinja2 requests invoke ; \
cd /opt ; git clone https://github.com/makhomed/nftables-tool.git

Upgrade

python3 -m pip install --no-input --upgrade-strategy eager --upgrade Jinja2 requests invoke ; \
cd /opt/nftables-tool ; git pull

Usage

/opt/nftables-tool/nftables-tool

or

/opt/nftables-tool/nftables-tool 172.21.0.0/16 2001:DB8:11:22::/64 2001:DB8:99:77::/64

Automation via cron

Configure cron job, for example, in file /etc/cron.d/nftables-tool:

RANDOM_DELAY=360

0 0 * * * root /opt/nftables-tool/nftables-tool

or

RANDOM_DELAY=360

0 0 * * * root /opt/nftables-tool/nftables-tool 172.21.0.0/16 2001:DB8:1:2::/64 2001:DB8:8:9::/64

TODO

About

Generate include file with set of all Cloudflare IPv4 and IPv6 subnets

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages