#!/usr/sbin/nft -f

flush ruleset

# DEFINITION

define ipv4_address = 185.252.147.100
define ipv6_address = 2a04:5200:fff5::2454


#in
define in_tcp_http = { 80, 443}
define in_tcp_ssh = { 18123 }
define in_udp = { 80, 443 }

#out
define out_tcp = { 43, 53, 80, 443, 465, 587 }
define out_udp = { 53, 123 }

table netdev filter {

    set bad_ips {
        type ipv4_addr
    }

    set bad_ips6 {
        type ipv6_addr
    }

    chain ingress {
        type filter hook ingress device ens3 priority -500;
        ip saddr @bad_ips drop
        ip6 saddr @bad_ips6 drop
        ip frag-off & 0x1fff != 0 drop
        ip saddr { \
        0.0.0.0/8, \
        10.0.0.0/8, \
        100.64.0.0/10, \
        127.0.0.0/8, \
        169.254.0.0/16, \
        172.16.0.0/12, \
        192.0.0.0/24, \
        192.0.2.0/24, \
        192.168.0.0/16, \
        198.18.0.0/15, \
        198.51.100.0/24, \
        203.0.113.0/24, \
        240.0.0.0/5, \
        224.0.0.0/3, \
#krogza 
#fail2ban stat
        46.148.40.0/24, \
        80.244.11.0/24, \
#paloaltonetworks.com
        198.235.24.185, \
        198.235.24.77 \
        } \
        drop
        ip6 saddr ::1/128 drop
        tcp flags & (fin|syn|rst|psh|ack|urg) == fin|syn|rst|psh|ack|urg drop
        tcp flags & (fin|syn|rst|psh|ack|urg) == 0x0 drop
        tcp flags syn \
        tcp option maxseg size 1-535 \
        drop
    }
}

table inet filter {

    set in_tcp_http {
    type inet_service
    elements = { $in_tcp_http }
    }
    set in_tcp_ssh {
    type inet_service
    elements = { $in_tcp_ssh }
    }

    set in_udp {
    type inet_service
    elements = { $in_udp }
    }

    set out_tcp {
    type inet_service
    elements = { $out_tcp }
    }

    set out_udp {
    type inet_service
    elements = { $out_udp }
    }


    set blackhole_ipv4 {
        type ipv4_addr
        flags dynamic, timeout
        size 65536
    }
    set blackhole_ipv6 {
        type ipv6_addr;
        flags dynamic, timeout;
        size 65536;
    }
    set blackhole_ipv4_2 {
        type ipv4_addr
        flags timeout
        size 65536
    }
    set blackhole_ipv6_2 {
        type ipv6_addr;
        flags timeout;
        size 65536;
    }
    set blackhole_ipv4_3 {
        type ipv4_addr
        flags timeout
        size 65536
    }
    set blackhole_ipv6_3 {
        type ipv6_addr;
        flags timeout;
        size 65536;
    }

    chain prerouting {

        type filter hook prerouting priority -150;


        ip saddr @blackhole_ipv4 update @blackhole_ipv4_2 { \
            ip saddr timeout 1d \
            } \
            drop

        ip6 saddr @blackhole_ipv6 update @blackhole_ipv6_2 { \
            ip6 saddr timeout 1d \
            } \
            drop

        ip saddr @blackhole_ipv4_2 update @blackhole_ipv4_3 { \
            ip saddr timeout 7d \
            } \
            drop

        ip6 saddr @blackhole_ipv6_2 update @blackhole_ipv6_3 { \
            ip6 saddr timeout 7d \
            } \
            drop

        ip saddr @blackhole_ipv4_3 drop
        ip6 saddr @blackhole_ipv6_3 drop

        ct state invalid drop
        
        tcp flags & (fin|syn|rst|ack) != syn \
        ct state new \
        drop

        tcp flags & (fin|syn|rst|ack) == syn ct state new \
        limit rate 30/second \
        accept

        iif != "lo" ip daddr 127.0.0.0/8 drop
        iif != "lo" ip6 daddr ::1/128 drop
        iif != "lo" ip saddr 127.0.0.0/8 drop
        iif != "lo" ip6 saddr ::1/128 drop

    }

    chain black_1 {

        add @blackhole_ipv4 { ip saddr timeout 12m } drop
        add @blackhole_ipv6 { ip6 saddr timeout 13m } drop

    }


    chain ip-input {

        # HTTP UDP
        tcp dport @in_tcp_http limit rate over 100/second goto black_1
        udp dport @in_udp limit rate over 100/second goto black_1
        tcp dport @in_tcp_http accept
        udp dport @in_udp accept

        # SSH

        ip protocol tcp tcp dport @in_tcp_ssh limit rate over 10/minute goto black_1
        ip protocol tcp tcp dport @in_tcp_ssh accept

    }


    chain input {

        type filter hook input priority 0; policy drop;

        iif lo accept

        ip protocol icmp icmp type echo-request limit rate over 5/second drop
        ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 5/second drop
 
        # ip protocol icmp limit rate over 10/second drop
        # ip6 nexthdr icmpv6 limit rate over 10/second drop

        ct state established,related accept

        ip protocol icmp icmp type echo-request accept

        ip protocol { tcp, udp } ip daddr $ipv4_address goto ip-input
        ip6 nexthdr { tcp, udp } ip6 daddr $ipv6_address goto ip-input
 
        # ICMP

        # ip6 nexthdr icmpv6 icmpv6 type { \
        #     echo-request, \
        #     destination-unreachable, \
        #     packet-too-big, \
        #     time-exceeded, \
        #     parameter-problem, \
        #     echo-reply, \
        #     nd-router-advert, \
        #     nd-neighbor-solicit, \
        #     nd-neighbor-advert \
        #     } \
        #     accept

        # ip protocol icmp icmp type { \
        #     echo-request, \
        #     destination-unreachable, \
        #     router-advertisement, \
        #     time-exceeded, \
        #     parameter-problem } \
        #     accept

#        goto black_1

    }

    chain forward {
        type filter hook forward priority 0; policy drop;
    }

    chain output {

        type filter hook output priority 0; policy drop;

        ip daddr @blackhole_ipv4_3 drop
        ip6 daddr @blackhole_ipv6_3 drop
        ip daddr @blackhole_ipv4_2 drop
        ip6 daddr @blackhole_ipv6_2 drop
        ip daddr @blackhole_ipv4 drop
        ip6 daddr @blackhole_ipv6 drop

        ct state invalid drop

        oif lo accept

        ct state { related, established } accept

        meta skuid Debian-exim meta skgid Debian-exim tcp dport { smtp, smtps, submission } accept

        tcp dport @out_tcp limit rate 100/second accept
        udp dport @out_udp limit rate 100/second accept

        ip protocol icmp icmp type echo-request accept
        ip6 nexthdr icmpv6 icmpv6 type echo-request accept
        meta l4proto icmp reject with icmp type host-unreachable
        meta l4proto ipv6-icmp reject with icmpv6 type no-route

        #meta l4proto {icmp, ipv6-icmp} accept

    }

}

include "/etc/nftables/bad_ip4.set"
include "/etc/nftables/bad_ip6.set"
include "/etc/nftables/bad_ip4_add.set"
include "/etc/nftables/bad_ip6_add.set"

include "/etc/nftables/blackhole_ipv4.set"
include "/etc/nftables/blackhole_ipv6.set"
include "/etc/nftables/blackhole_ipv4_2.set"
include "/etc/nftables/blackhole_ipv6_2.set"
include "/etc/nftables/blackhole_ipv4_3.set"
include "/etc/nftables/blackhole_ipv6_3.set"