#!/usr/sbin/nft -f
# Das OS server firewall: incoming connections are closed except SSH.
#
# Only the "das" table is replaced, so loading this file again
# (dsv restart nftables) keeps the rules of Docker and fail2ban.
# Ports that Docker containers publish (-p 8080:80) pass through Docker's
# own forwarding rules, not the input chain below.

table inet das
delete table inet das

table inet das {
	chain input {
		type filter hook input priority filter; policy drop;

		ct state established,related accept
		ct state invalid drop
		iif lo accept
		meta l4proto { icmp, ipv6-icmp } accept
		# DHCPv6 answers come from the router's link-local address
		ip6 saddr fe80::/10 udp dport dhcpv6-client accept
		# Containers may reach services on the host (DNS, a database...)
		iifname "docker0" accept
		iifname "br-*" accept

		tcp dport ssh accept

		# Open more ports here, then: dsv restart nftables
		# tcp dport { http, https } accept
	}
}