To allow outgoing SSH connections on your server using nftables, you can create a custom rule set. Here's a step-by-step guide on how to create and apply the rule:
-
First, ensure that you have installed nftables on your server. If it's not installed, you can install it using the following command:
sudo apt-get install nftables -
Create a new file for the rule set. For example, create a file named
outgoing_ssh.nft:sudo nano /etc/nftables/ip.d/outgoing_ssh -
Add the following rules to the file:
table inet filter { chain input { type filter hook input priority 0; policy drop; } chain output { type filter hook output priority 0; policy accept; iif lo ct state established,related accept tcp dport 22 accept } }This rule set allows outgoing SSH connections (TCP port 22) from your server and drops all other incoming traffic.
-
Save and close the file by pressing
Ctrl+X, thenY, andEnter. -
To load the new rule set, run the following command:
sudo nft -f /etc/nftables/ip.d/outgoing_ssh -
To ensure the rule set is loaded at boot, add the following line to the
/etc/nftables/nftables.conffile:/etc/nftables/ip.d/outgoing_sshSave and close the file, then reload the nftables configuration:
sudo nft -f /etc/nftables/nftables.conf
Now, your server should only allow outgoing SSH connections to the backup server.