Language Modules
Modules common protections that ship with moat.
use std.NAME inserts the rules of a standard module at that place, so
they take part in first-match order like any other rule. Their names are
std.NAME.RULE. moat std list and moat std show NAME print them.
| Module | Drops |
|---|---|
std.bogons | Sources that are never valid on the wire: loopback, documentation, benchmarking, multicast and reserved ranges, IPv4 and IPv6. Link-local, unique local and the unspecified address are kept, since hosts need them. Safe on cloud VMs. |
std.private_sources | Private, shared, link-local and 0.0.0.0/8 sources, and IPv6 unique local. Only for an interface with a public address and nothing private behind it. |
std.amplification | UDP answers from services abused for reflection arriving on ports below 32768. DNS, NTP, NetBIOS, RIP, mDNS and SSDP between their own ports, and SNMP traps, are allowed. |
std.tcp_sanity | NULL, Xmas, SYN+FIN, SYN+RST, FIN+RST and FIN without ACK. |
std.amplification assumes the host's own clients receive answers on ports from 32768 up, the Linux default. Do not use it with a resolver that picks lower ports, such as unbound, or with a lowered ip_local_port_range.