I’m configuring nftables for the almost first time.
I wan to apply strict rule on one server to allow only outgoing ssh to one backup server (scp).
I applied the following ruleset, but the ssh connection timeout.
If I flush the rule it instantly works. Where is the problem?
table inet ssh_backup {
chain input {
type filter hook input priority filter; policy drop;
iif "lo" accept
iif "lo" ip saddr != 127.0.0.0/8 drop
ip saddr 53.75.121.201 tcp sport 22 accept
}
chain output {
type filter hook output priority filter; policy drop;
oif "lo" accept
oif "lo" ip daddr != 127.0.0.0/8 drop
ip daddr 53.75.121.201 tcp dport 22 accept
}
chain forward {
type filter hook output priority filter; policy drop;
}
}