ctucx.git: nixfiles

machines/lollo/router: drop incomming netbios traffic

diff --git a/machines/lollo/router/ruleset.nft b/machines/lollo/router/ruleset.nft
@@ -57,6 +57,10 @@ table inet firewall {
         ip6 nexthdr ipv6-icmp limit rate 5/second accept
         ip protocol igmp limit rate 5/second accept
 
+        # drop incomming netbios traffic
+        tcp dport {139, 445} counter drop comment "silently drop NetBios"
+        udp dport {137, 138} counter drop comment "silently drop NetBios"
+
         #make public ips world accessible 
         ip daddr 195.39.246.33/28 accept
     }