#!/usr/sbin/nft -f
# Das OS server firewall: incoming connections are closed except SSH.
#
# Open ports with dfw (dfw allow 80/tcp), which keeps them in
# /etc/nftables.d/dfw.nft. Ports that Docker containers publish (-p 8080:80)
# pass through Docker's own forwarding rules, not the input chain below.
#
# After editing this file: dfw reload. Only the "das" table is replaced, so the
# rules of Docker and fail2ban stay. Do not restart the nftables service for
# that: its finish script flushes the whole ruleset, theirs too.

table inet das
delete table inet das

table inet das {
	# Filled by dfw
	set tcp_ports {
		type inet_service; flags interval; auto-merge;
	}
	set udp_ports {
		type inet_service; flags interval; auto-merge;
	}

	chain input {
		type filter hook input priority filter; policy drop;

		ct state established,related accept
		ct state invalid drop
		iif lo accept
		meta l4proto { icmp, ipv6-icmp } accept
		# DHCPv6 answers come from the router's link-local address
		ip6 saddr fe80::/10 udp dport dhcpv6-client accept
		# Containers may reach services on the host (DNS, a database...)
		iifname "docker0" accept
		iifname "br-*" accept

		tcp dport ssh accept
		tcp dport @tcp_ports accept
		udp dport @udp_ports accept

		# Rules of your own go here, e.g. a port for one network only:
		# ip saddr 192.168.1.0/24 tcp dport 5432 accept
	}
}

# dfw's ports and drop-ins of your own
include "/etc/nftables.d/*.nft"