История изменений

Исправление intelfx, 19.02.19 06:05 (текущая версия) :

Во-первых, ты можешь собрать iptables ≥1.8.0 так, что он на самом деле будет прозрачно транслировать правила в nftables и ты этого (в идеале) даже не заметишь.

Во-вторых, держи:

flush ruleset

table inet filter {
	chain iface_common {
		# trusted interfaces
		iifname { lo, tun0, ve-arch } accept
	}

	chain ct_common {
		# early drop of invalid connections
		ct state invalid drop

		# allow established/related connections
		ct state { established, related } accept

		# allow dnat-ed connections
		ct status dnat accept
	}
	chain srv_common {
		# allow icmp
		ip protocol icmp limit rate 1000/second accept
		ip6 nexthdr icmpv6 limit rate 1000/second accept
	}
	chain input {
		type filter hook input priority 0; policy drop;

		jump iface_common
		jump ct_common
		jump srv_common

		tcp dport ssh accept
		udp dport openvpn accept
		udp dport 60000-61000 accept
		tcp dport 8388 accept

		tcp dport 12345 accept
		udp dport 12345 accept
	}
	chain forward {
		type filter hook forward priority 0; policy drop;

		jump iface_common
		jump ct_common
		jump srv_common

		# e:d to able
		ip6 daddr [2a01:7e01:e002:8500::1000] tcp dport 5100 accept
	}
	chain output {
		type filter hook output priority 0; policy accept;
	}
}
table ip nat {
	chain dstnat {
		type nat hook prerouting priority 0; policy accept;

		# e:d to able
		tcp dport 5100 dnat to 10.139.24.2
	}

	chain srcnat {
		type nat hook postrouting priority 100; policy accept;

		oifname enp0s3 masquerade
	}
}

Дальше разберёшься сам.

Исходная версия intelfx, 19.02.19 06:05:

Во-вторых, держи:

flush ruleset

table inet filter {
	chain iface_common {
		# trusted interfaces
		iifname { lo, tun0, ve-arch } accept
	}

	chain ct_common {
		# early drop of invalid connections
		ct state invalid drop

		# allow established/related connections
		ct state { established, related } accept

		# allow dnat-ed connections
		ct status dnat accept
	}
	chain srv_common {
		# allow icmp
		ip protocol icmp limit rate 1000/second accept
		ip6 nexthdr icmpv6 limit rate 1000/second accept
	}
	chain input {
		type filter hook input priority 0; policy drop;

		jump iface_common
		jump ct_common
		jump srv_common

		tcp dport ssh accept
		udp dport openvpn accept
		udp dport 60000-61000 accept
		tcp dport 8388 accept

		tcp dport 12345 accept
		udp dport 12345 accept
	}
	chain forward {
		type filter hook forward priority 0; policy drop;

		jump iface_common
		jump ct_common
		jump srv_common

		# e:d to able
		ip6 daddr [2a01:7e01:e002:8500::1000] tcp dport 5100 accept
	}
	chain output {
		type filter hook output priority 0; policy accept;
	}
}
table ip nat {
	chain dstnat {
		type nat hook prerouting priority 0; policy accept;

		# e:d to able
		tcp dport 5100 dnat to 10.139.24.2
	}

	chain srcnat {
		type nat hook postrouting priority 100; policy accept;

		oifname enp0s3 masquerade
	}
}