fox_firewall_nftables.conf

#!/usr/sbin/nft -f

# This configuration file is customized by fox,
# Optimize nftables rules for Linux Router.

table inet router
flush table inet router

table inet router {

    #
    # NFTsets
    #

    set local_dns_ipv4 {
        type ipv4_addr;
        elements = { 172.16.1.2, 172.16.1.3 };
    }

    set local_dns_ipv6 {
        type ipv6_addr;
        elements = { ::0000:00ff:fe00:0001, ::0000:00ff:fe00:0002 };
    }


    #
    # Flowtable
    #

    flowtable ft {
        hook ingress priority filter;
        devices = { enp6s18, enp6s19, enp6s20, enp6s21 };
        counter;
    }


    #
    # Filter rules
    #

    chain input {
        type filter hook input priority filter; policy drop;
        ct state established,related accept comment "defconf: handle inbound flows"
        iif "lo" accept comment "defconf: accept traffic from loopback"
        ct state new meta l4proto tcp jump syn_flood comment "defconf: rate limit new TCP connections"
        iifname "bridge1" jump input_lan comment "defconf: handle LAN IPv4 / IPv6 input traffic"
        iifname { "pppoe1", "enp6s18" } jump input_wan comment "defconf: handle WAN IPv4 / IPv6 input traffic"
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
        ct state established,related goto handle_offload comment "defconf: handle forwarded flows"
        iifname "bridge1" jump forward_lan comment "defconf: handle LAN IPv4 / IPv6 forward traffic"
        iifname { "pppoe1", "enp6s18" } jump forward_wan comment "defconf: handle WAN IPv4 / IPv6 forward traffic"
    }

    chain output {
        type filter hook output priority filter; policy accept;
        ct state vmap { established : accept, related : accept, invalid : drop } comment "defconf: handle outbound flows"
        oif "lo" accept comment "defconf: accept traffic towards loopback"
        oifname "bridge1" jump output_lan comment "defconf: handle LAN IPv4 / IPv6 output traffic"
        oifname { "pppoe1", "enp6s18" } jump output_wan comment "defconf: handle WAN IPv4 / IPv6 output traffic"
    }

    chain prerouting {
        type filter hook prerouting priority filter; policy accept;
        ct state invalid counter drop comment "defconf: drop packets in invalid flow state"
        iifname "bridge1" jump helper_lan comment "defconf: handle LAN IPv4 / IPv6 helper assignment"
    }

    chain syn_flood {
        limit rate 200/second burst 100 packets return comment "defconf: accept new TCP connections below rate-limit"
        counter drop comment "defconf: drop excess new TCP connections"
    }

    chain handle_offload {
        flow add @ft comment "defconf: track forwarded flows"
        accept
    }

    chain input_lan {
        ct status dnat accept comment "lanconf: accept port redirect"
        jump accept_from_lan
    }

    chain forward_lan {
        jump accept_to_wan comment "defconf: accept LAN to WAN forwarding"
        ct status dnat accept comment "lanconf: accept port forwards"
        jump accept_to_lan
    }

    chain output_lan {
        jump accept_to_lan
    }

    chain helper_lan {
    }

    chain accept_from_lan {
        iifname "bridge1" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
    }

    chain accept_to_lan {
        oifname "bridge1" accept comment "defconf: accept LAN IPv4 / IPv6 traffic"
    }

    chain input_wan {
        meta nfproto ipv4 udp dport 68 counter accept comment "defconf: allow DHCP renew"
        meta nfproto ipv4 icmp type echo-request counter drop comment "defconf: drop ICMP-Ping input"
        meta nfproto ipv4 meta l4proto igmp counter accept comment "defconf: allow IGMP"
        ip6 daddr fe80::/10 udp dport 546 counter accept comment "defconf: allow DHCPv6"
        ip6 saddr fe80::/10 icmpv6 type . icmpv6 code { mld-listener-query . no-route, mld-listener-report . no-route, mld-listener-done . no-route, mld2-listener-report . no-route } counter accept comment "defconf: allow MLD"
        meta nfproto ipv6 icmpv6 type echo-request counter drop comment "defconf: drop ICMPv6-Ping input"
        meta nfproto ipv6 icmpv6 type { destination-unreachable, time-exceeded, echo-reply, nd-router-solicit, nd-router-advert } limit rate 200/second burst 100 packets counter accept comment "defconf: allow ICMPv6 input"
        meta nfproto ipv6 icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, nd-neighbor-solicit . no-route, nd-neighbor-advert . no-route, parameter-problem . admin-prohibited } limit rate 200/second burst 100 packets counter accept comment "defconf: allow ICMPv6 input"
        jump drop_from_wan
    }

    chain forward_wan {
        meta nfproto ipv6 icmpv6 type { destination-unreachable, time-exceeded, echo-request, echo-reply } limit rate 200/second burst 100 packets counter accept comment "defconf: allow ICMPv6 forward"
        meta nfproto ipv6 icmpv6 type . icmpv6 code { packet-too-big . no-route, parameter-problem . no-route, parameter-problem . admin-prohibited } limit rate 200/second burst 100 packets counter accept comment "defconf: allow ICMPv6 forward"
        jump drop_to_wan
    }

    chain output_wan {
        jump accept_to_wan
    }

    chain accept_to_wan {
        oifname { "pppoe1", "enp6s18" } accept comment "defconf: accept WAN IPv4 / IPv6 traffic"
    }

    chain drop_from_wan {
        iifname { "pppoe1", "enp6s18" } counter drop comment "defconf: drop WAN IPv4 / IPv6 traffic"
    }

    chain drop_to_wan {
        oifname { "pppoe1", "enp6s18" } counter drop comment "defconf: drop WAN IPv4 / IPv6 traffic"
    }


    #
    # NAT rules
    #

    chain dstnat {
        type nat hook prerouting priority dstnat; policy accept;
        iifname "bridge1" meta l4proto { tcp, udp } th dport domain jump dstnat_lan comment "defconf: handle LAN IPv4 / IPv6 dstnat traffic"
    }

    chain srcnat {
        type nat hook postrouting priority srcnat; policy accept;
        oifname { "pppoe1", "enp6s18" } jump srcnat_wan comment "defconf: handle WAN IPv4 / IPv6 srcnat traffic"
    }

    chain dstnat_lan {
        ip saddr @local_dns_ipv4 meta l4proto { tcp, udp } th dport domain counter accept comment "lanconf: accept LAN IPv4 DNS bootstrap query"
        ip6 saddr & ::ffff:ffff:ffff:ffff == @local_dns_ipv6 meta l4proto { tcp, udp } th dport domain counter accept comment "lanconf: accept LAN IPv6 DNS bootstrap query"
        meta nfproto ipv4 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: LAN IPv4 DNS redirect"
        meta nfproto ipv6 meta l4proto { tcp, udp } th dport domain counter redirect to domain comment "lanconf: LAN IPv6 DNS redirect"
    }

    chain srcnat_wan {
        meta nfproto ipv4 masquerade comment "defconf: masquerade WAN IPv4 traffic"
    }


    #
    # Raw rules (notrack)
    #

    chain raw_prerouting {
        type filter hook prerouting priority raw; policy accept;
    }

    chain raw_output {
        type filter hook output priority raw; policy accept;
    }


    #
    # Mangle rules
    #

    chain mangle_prerouting {
        type filter hook prerouting priority mangle; policy accept;
    }

    chain mangle_postrouting {
        type filter hook postrouting priority mangle; policy accept;
        ct packets < 20 oifname { "pppoe1", "enp6s18" } tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone WAN IPv4 / IPv6 egress MTU fixing"
    }

    chain mangle_input {
        type filter hook input priority mangle; policy accept;
    }

    chain mangle_output {
        type route hook output priority mangle; policy accept;
    }

    chain mangle_forward {
        type filter hook forward priority mangle; policy accept;
        ct packets < 20 iifname { "pppoe1", "enp6s18" } tcp flags syn / fin,syn,rst tcp option maxseg size set rt mtu comment "defconf: zone WAN IPv4 / IPv6 ingress MTU fixing"
    }

}