$ sudo iptables-save
Generated by iptables-save v1.8.7 on Sat Jan 21 07:41:10 2023
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [580599:435840972]
:InstanceServices - [0:0]
-A INPUT -p tcp -m tcp --dport 8443 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m udp --sport 123 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -d 169.254.0.0/16 -j InstanceServices
-A InstanceServices -d 169.254.0.2/32 -p tcp -m owner --uid-owner 0 -m tcp --dport 3260 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.2.0/24 -p tcp -m owner --uid-owner 0 -m tcp --dport 3260 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.4.0/24 -p tcp -m owner --uid-owner 0 -m tcp --dport 3260 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.5.0/24 -p tcp -m owner --uid-owner 0 -m tcp --dport 3260 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.0.2/32 -p tcp -m tcp --dport 80 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p udp -m udp --dport 53 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p tcp -m tcp --dport 53 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.0.3/32 -p tcp -m owner --uid-owner 0 -m tcp --dport 80 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.0.4/32 -p tcp -m tcp --dport 80 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p udp -m udp --dport 67 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p udp -m udp --dport 69 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p udp -m udp --dport 123 -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j ACCEPT
-A InstanceServices -d 169.254.0.0/16 -p tcp -m tcp -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j REJECT --reject-with tcp-reset
-A InstanceServices -d 169.254.0.0/16 -p udp -m udp -m comment --comment “See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule” -j REJECT --reject-with icmp-port-unreachable
COMMIT
Completed on Sat Jan 21 07:41:10 2023
$ sudo nft list ruleset
table ip filter {
chain INPUT {
type filter hook input priority filter; policy accept;
meta l4proto tcp tcp dport 8443 counter packets 61161 bytes 9095699 accept
ct state related,established counter packets 709488 bytes 849973254 accept
meta l4proto icmp counter packets 1 bytes 80 accept
iifname “lo” counter packets 23284 bytes 2020709 accept
meta l4proto udp udp sport 123 counter packets 0 bytes 0 accept
meta l4proto tcp ct state new tcp dport 22 counter packets 26619 bytes 1567650 accept
counter packets 8566 bytes 2804598 reject with icmp type host-prohibited
}
chain FORWARD {
type filter hook forward priority filter; policy accept;
counter packets 0 bytes 0 reject with icmp type host-prohibited
}
chain OUTPUT {
type filter hook output priority filter; policy accept;
ip daddr 169.254.0.0/16 counter packets 67870 bytes 5224050 jump InstanceServices
}
chain InstanceServices {
meta l4proto tcp ip daddr 169.254.0.2 skuid 0 tcp dport 3260 counter packets 0 bytes 0 accept
meta l4proto tcp ip daddr 169.254.2.0/24 skuid 0 tcp dport 3260 counter packets 0 bytes 0 accept
meta l4proto tcp ip daddr 169.254.4.0/24 skuid 0 tcp dport 3260 counter packets 0 bytes 0 accept
meta l4proto tcp ip daddr 169.254.5.0/24 skuid 0 tcp dport 3260 counter packets 0 bytes 0 accept
meta l4proto tcp ip daddr 169.254.0.2 tcp dport 80 counter packets 0 bytes 0 accept
meta l4proto udp ip daddr 169.254.169.254 udp dport 53 counter packets 18649 bytes 1727793 accept
meta l4proto tcp ip daddr 169.254.169.254 tcp dport 53 counter packets 0 bytes 0 accept
meta l4proto tcp ip daddr 169.254.0.3 skuid 0 tcp dport 80 counter packets 0 bytes 0 accept
meta l4proto tcp ip daddr 169.254.0.4 tcp dport 80 counter packets 0 bytes 0 accept
meta l4proto tcp ip daddr 169.254.169.254 tcp dport 80 counter packets 49005 bytes 3477762 accept
meta l4proto udp ip daddr 169.254.169.254 udp dport 67 counter packets 9 bytes 2763 accept
meta l4proto udp ip daddr 169.254.169.254 udp dport 69 counter packets 0 bytes 0 accept
meta l4proto udp ip daddr 169.254.169.254 udp dport 123 counter packets 207 bytes 15732 accept
meta l4proto tcp ip daddr 169.254.0.0/16 counter packets 0 bytes 0 reject with tcp reset
meta l4proto udp ip daddr 169.254.0.0/16 counter packets 0 bytes 0 reject
}
}
table ip6 filter {
chain INPUT {
type filter hook input priority filter; policy accept;
}
chain FORWARD {
type filter hook forward priority filter; policy accept;
}
chain OUTPUT {
type filter hook output priority filter; policy accept;
}
}
table inet lxd {
chain pstrt.lxdbr0 {
type nat hook postrouting priority srcnat; policy accept;
ip saddr 10.224.230.0/24 ip daddr != 10.224.230.0/24 masquerade
ip6 saddr fd42:459e:bdd8:8c38::/64 ip6 daddr != fd42:459e:bdd8:8c38::/64 masquerade
}
}