#!/usr/sbin/nft -f
# Host firewall for the Clank Together server. Uses its own table so Docker's
# rules are left alone. Inbound: SSH, HTTP (ACME + redirect), HTTPS only.

table inet td_filter
delete table inet td_filter

table inet td_filter {
	chain input {
		type filter hook input priority 0; policy drop;

		ct state established,related accept
		ct state invalid drop
		iif "lo" accept
		ip protocol icmp accept
		ip6 nexthdr icmpv6 accept

		tcp dport 22 ct state new limit rate 30/minute accept
		tcp dport { 80, 443 } accept
		udp dport 443 accept
	}

	chain forward {
		type filter hook forward priority 0; policy accept;
	}
}