#!/usr/bin/nft
flush ruleset

include "./defines.nft"
include "/var/geoipsets/dbip/nftset/ipv4/*.ipv4"

table ip filter {
	set allowed_tcp_ports {
		type inet_service; flags constant;
		elements = {
			$SSH_PORT1, $SSH_PORT2, $DNS_PORT, $HTTP_PORT, $HTTPS_PORT, $SYNCPLAY_PORT,
			$TERRARIA_PORT, $OPENTTD_PORT, $MAINPAGE_PORT, $NEXTCLOUD_PORT, $GITEA_PORT,
			$POSTGRESQL_PORT
		};
	}

	set allowed_udp_ports_in {
		type inet_service; flags constant;
		elements = { $DNS_PORT, $DHCP_IN_PORT, $OPENVPN_PORT, $FACTORIO_PORT, $OPENTTD_PORT, $CSTRIKE_PORT, $SNMP_POLL_PORT, $SNMP_TRAP_PORT }
	}

	set allowed_udp_ports_out {
		type inet_service; flags constant;
		elements = { $DNS_PORT, $DHCP_OUT_PORT, $SNMP_POLL_PORT }
	}

	set ipv4_geo_blacklist {
		type ipv4_addr; flags interval;
		elements = { };
	}

	chain in {
		type filter hook input priority filter; policy drop;
		ip saddr @ipv4_geo_blacklist drop;
		ct state vmap { invalid : drop, related : accept, established : accept };
		iifname "lo" accept;
		icmp type echo-request accept;
		tcp dport @allowed_tcp_ports accept;
		udp dport @allowed_udp_ports_in accept;
	}

	chain forward {
		type filter hook forward priority filter; policy drop;
		comment "this routes vpn traffic";
		ct state related,established accept;
		iifname "tun0" oifname "eth0" accept;
	}

	chain out {
		type filter hook output priority filter; policy drop;
		ip daddr @ipv4_geo_blacklist drop;
		ct state vmap { invalid : drop, related : accept, established : accept, new : accept };
		udp dport @allowed_udp_ports_out accept;
		oifname "lo" accept;
		icmp type echo-reply accept;
	}
}

include "./nat.nft"