#!/usr/bin/nft -f

# IPv4/IPv6 Simple & Safe firewall ruleset.
# More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/.


define NET_LXD = 10.98.46.0/24


flush ruleset

table inet filter {
    chain input {
        type filter hook input priority filter; policy drop;

        ct state invalid drop comment "early drop of invalid connections"
        ct state {established, related} accept comment "allow tracked connections"
        iifname lo accept comment "allow from loopback"
        ip protocol icmp accept comment "allow icmp"
        #ip protocol icmp type { echo-request, echo-reply } accept comment "allow icmp"
        #meta l4proto ipv6-icmp accept comment "allow icmp v6"

        ip saddr $NET_LXD accept

        jump in.lxdbr0

        pkttype host limit rate 5/second counter reject with icmpx type admin-prohibited
        counter
    }

    chain output {
        type filter hook output priority filter; policy accept;
        jump out.lxdbr0
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
        jump fwd.lxdbr0
    }

    chain pstrt.lxdbr0 {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 10.98.46.0/24 ip daddr != 10.98.46.0/24 masquerade
    }

    chain fwd.lxdbr0 {
        ip version 4 oifname "lxdbr0" accept
        ip version 4 iifname "lxdbr0" accept
    }

    chain in.lxdbr0 {
        iifname "lxdbr0" tcp dport 53 accept
        iifname "lxdbr0" udp dport 53 accept
        iifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
        iifname "lxdbr0" udp dport 67 accept
    }

    chain out.lxdbr0 {
        oifname "lxdbr0" tcp sport 53 accept
        oifname "lxdbr0" udp sport 53 accept
        oifname "lxdbr0" icmp type { destination-unreachable, time-exceeded, parameter-problem } accept
        oifname "lxdbr0" udp sport 67 accept
    }
}