#!/usr/sbin/nft -f

flush ruleset

define ipv4_address = 185.252.147.100
define ipv6_address = 2a04:5200:fff5::2454

define in_tcp_http = { 80, 443}
define in_tcp_ssh = { 18123 }
define in_udp = { 80, 443 }

define out_tcp = { 25, 43, 53, 80, 443, 465, 587, 18130 }
define out_udp = { 53, 80, 123, 443 }

table inet filter {

    set in_tcp_http {
    type inet_service
    elements = { $in_tcp_http }
    }
    set in_tcp_ssh {
    type inet_service
    elements = { $in_tcp_ssh }
    }

    set in_udp {
    type inet_service
    elements = { $in_udp }
    }

    set out_tcp {
    type inet_service
    elements = { $out_tcp }
    }

    set out_udp {
    type inet_service
    elements = { $out_udp }
    }

   chain ip-input {

        tcp dport @in_tcp_http accept
        udp dport @in_udp accept

        ip protocol tcp tcp dport @in_tcp_ssh limit rate 10/minute accept

    }

    chain prerouting {

        type filter hook prerouting priority -150;

        ct state invalid drop

        tcp flags & (fin|syn|rst|ack) != syn \
        ct state new \
        drop

        tcp flags & (fin|syn|rst|ack) == syn ct state new \
        limit rate 30/second \
        accept
        iif != "lo" ip daddr 127.0.0.0/8 drop
        iif != "lo" ip6 daddr ::1/128 drop

    }

  chain input {
        type filter hook input priority 0; policy drop;
        iif lo accept
        meta l4proto icmp icmp type echo-request limit rate over 10/second burst 4 packets drop
        meta l4proto ipv6-icmp icmpv6 type echo-request limit rate over 10/second burst 4 packets drop

        ct state { related, established } accept

        meta l4proto icmp icmp type echo-request accept
        meta l4proto ipv6-icmp icmpv6 type echo-request accept

        ip protocol { tcp, udp } ip daddr $ipv4_address goto ip-input
        ip6 nexthdr { tcp, udp } ip6 daddr $ipv6_address goto ip-input

        meta l4proto ipv6-icmp icmpv6 type { destination-unreachable, packet-too-big, time-exceeded, parameter-problem, mld-listener-query, mld-listener-report, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report } limit rate 100/second accept
        meta l4proto icmp icmp type { destination-unreachable, router-solicitation, router-advertisement, time-exceeded, parameter-problem } limit rate 100/second accept
    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    chain output {

        type filter hook output priority 0; policy drop;

        oif lo accept
        ct state invalid drop
        ct state { related, established } accept

#        meta skuid postfix meta skgid postfix tcp dport { smtp, smtps, submission } accept

        tcp dport @out_tcp accept
        udp dport @out_udp accept

        meta l4proto {icmp, ipv6-icmp} accept

    }

}

table netdev filter {
    chain ingress {
        type filter hook ingress device ens3 priority -500;
        ip frag-off & 0x1fff != 0 drop
        ip saddr { \
        0.0.0.0/8, \
        10.0.0.0/8, \
        100.64.0.0/10, \
        127.0.0.0/8, \
        169.254.0.0/16, \
        172.16.0.0/12, \
        192.0.0.0/24, \
        192.0.2.0/24, \
        192.168.0.0/16, \
        198.18.0.0/15, \
        198.51.100.0/24, \
        203.0.113.0/24, \
        240.0.0.0/5, \
        224.0.0.0/3, \
        194.169.175.10 \
        } \
        drop
        ip6 saddr ::1/128 drop
        tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg drop
        tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 drop
        tcp flags syn \
        tcp option maxseg size 1-535 \
        drop
    }
}