#!/usr/bin/nft
flush ruleset

include "./defines.nft"

table ip filter {
	set allowed_tcp_ports {
		type inet_service;
		flags constant;
		elements = { $SSH_PORT1, $SSH_PORT2, $DNS_PORT, $HTTP_PORT, $HTTPS_PORT };
	}

	set allowed_udp_ports_in {
		type inet_service;
		flags constant;
		elements = { $DNS_PORT, $DHCP_IN_PORT }
	}

	set allowed_udp_ports_out {
		type inet_service;
		flags constant;
		elements = { $DNS_PORT, $DHCP_OUT_PORT }
	}

	chain in {
		type filter hook input priority filter; policy drop;
		ct state invalid drop;
		ct state {related,established} accept;
		iifname "lo" accept;
		tcp dport @allowed_tcp_ports accept;
		udp dport @allowed_udp_ports_in accept;
	}
	chain forward {
		type filter hook forward priority filter; policy drop;
	}

	chain out {
		type filter hook output priority filter; policy drop;
		udp dport @allowed_udp_ports_out accept;
		oifname "lo" accept;
	}
}