#!/usr/sbin/nft -f

define WAN = eth0
define LAN = br0
define NET = 192.168.0.0/24

# Drop all rules to allow reloading this file after edit
flush ruleset

table ip filter {
    chain wan {
        # Accept ping for diagnostics, with rate limit
        icmp type echo-request limit rate 5/second accept

        # allow SSH connections from some well-known internet host
        #ip saddr 81.209.165.42 tcp dport ssh accept
    }

    chain lan {
        icmp type echo-request accept

	# allow DHCP, DNS and SSH from the private network
        ip protocol . th dport vmap {
	    tcp . 22 : accept,
	    udp . 53 : accept,
	    tcp . 53 : accept,
	    udp . 67 : accept
	}
    }

    chain input {
        type filter hook input priority 0; policy drop;

        # Allow traffic from established and related packets, drop invalid
        ct state vmap {
	    established : accept,
	    related     : accept,
	    invalid     : drop
	}

        # allow loopback traffic, anything else jump to chain for further evaluation
        iifname vmap {
	    lo   : accept,
	    $WAN : jump wan,
	    $LAN : jump lan
	}

        # the rest is dropped by the above policy
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        # Allow traffic from established and related packets, drop invalid
        ct state vmap {
	    established : accept,
	    related     : accept,
	    invalid     : drop
	}

        # connections from LAN to the internet or to other intranets are allowed
        iifname $LAN accept

        # the rest is dropped by the above policy
    }
}

table ip nat {
    chain prerouting {
        type nat hook prerouting priority filter; policy accept;
    }

    chain postrouting {
        type nat hook postrouting priority srcnat; policy accept;
	ip saddr $NET oif $WAN masquerade
    }
}